manchester 
arena 
inquiry 


Manchester Arena Inquiry 
Volume 1: Security for the Arena 


Report of the Public Inquiry into the 
Attack on Manchester Arena 
on 22™ May 2017 


Chairman: The Hon Sir John Saunders 


June 2021 


HC 279 


manchester 
arena 
inquiry 


Manchester Arena Inquiry 
Volume 1: Security for the Arena 


Report of the Public Inquiry into the 
Attack on Manchester Arena 
on 22™ May 2017 


Chairman: The Hon Sir John Saunders 


Presented to Parliament pursuant to section 26 of the Inquiries Act 2005 
Ordered by the House of Commons to be printed 17 June 2021 


HC 279 


OGL 


© Crown copyright 2021 


This publication is licensed under the terms of the Open Government Licence v3.0 except where 
otherwise stated. To view this licence, visit 
nationalarchives.gov.uk/doc/open-government-licence/version/3 


Where we have identified any third party copyright information you will need to obtain permission from 
the copyright holders concerned. 


This publication is available at www.gov.uk/official-documents 


Any enquiries regarding this publication should be sent to us at contacta@manchesterarenainquiry.org.uk 
ISBN 978-1-5286-2605-7 


CCS0321126370 06/21 
Printed on paper containing 75% recycled fibre content minimum 


Printed in the UK by the APS Group on behalf of the Controller of Her Majesty's Stationery Office 


On 22" May 2017, twenty-two innocent people were murdered in Manchester at the 
end of a concert performed by the American artist, Ariana Grande. In addition, hundreds 
were injured. Many suffered life-changing physical harm, many others psychological 
trauma. There were acts of bravery by those who came to the assistance of the dying 
and the injured. Many of those rescuers bear the scars of what they experienced. None 
of those affected will forget that night and nor must we. Those events are the reason for 
this Inquiry and have remained central to it. 


The families of those who died have been devastated by these events and those who 
were injured will live with the effects for the rest of their lives. 


The explosion that brought about these appalling consequences was caused by Salman 
Abedi detonating a bomb in the City Room, an area close to one of the exit doors from 
the Arena. These events will be referred to in the Report as ‘the Attack’. He chose a 
place where members of the audience were meeting up with parents and others who 
had come to collect them. The audience was principally made up of young people. 
Salman Abedi killed himself in the explosion, but he intended that as many people as 
possible would die with him. 


It was a wicked act, inspired by the distorted ideology of the so-called Islamic State. 
It was designed to attack our way of life and the freedoms we enjoy. We cannot allow 
fear of further terrorist attacks to achieve that. 


The responsibility for the events of 22" May 2017 lies with Salman and Hashem Abedi, 
his younger brother. Rather than use their full names, throughout the remainder of this 
Report, | shall refer to them as SA and HA. | have had in mind while writing this Report, 
as everyone who reads it should, that responsibility rests with them. This volume of my 
Report and those which follow must nonetheless examine the actions of others. | must 
decide whether more could and should have been done to stop SA detonating his 
bomb on 22nd May and to respond to the detonation when it occurred. 


This Inquiry cannot remove the hurt of those who have suffered the loss of a child, 
partner, relative or friend. It cannot ease the pain from the physical or psychological 
injuries that were suffered. What it can seek to do Is reduce the risk of such an event 
happening again and, if it does, mitigate the harm it causes. 


In order to try and identify recommendations which will have this effect, it has 

been necessary to subject the lead up to and the events on 227 May to intense 
scrutiny. As a result, some individuals and some organisations will be the subject of 
criticism. That is because, without examining what went wrong and why, | could not 
identify improvements. 
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After the deaths, inquests had to take place. In August 2018 | was appointed by the Lord 
Chief Justice and the Chief Coroner to conduct those inquests as the nominated judge 
to sit as the Coroner. 


Following a ruling | made in 2019 about the relevance of material to which public 
interest immunity attaches, the Inquiry was established in October 2019 in order to 
permit me to investigate that material. Evidence within the scope of the inquests will 
form part of the material | consider in the Inquiry. 


There are a number of ways in which the fact that | am conducting my investigation 
within the framework of a statutory public inquiry has brought benefits. Over and above 
the fact that | am now permitted to scrutinise material which could not have been 
considered within the inquests, the public inquiry framework requires me to write this 
Report. As a result, the detail and analysis that | am able to address in writing is greater. 
While this Inquiry and my Report can never repair the damage caused by SA and HA, it 
is my intention that it will seek to provide answers to the bereaved families, those who 
survived this terrible act and the public at large. 


My Report will be in three volumes: 


e Volume 1 will address the security arrangements at the Ariana Grande concert. 
It will identify the missed opportunities for detecting and stopping SA or reducing 
the harm he caused. | am publishing this volume now so that any recommendations 
that | make can be considered as soon as possible. The government Is consulting on 
a ‘Protect Duty’ and some of what | say in this volume of my Report will be relevant 
to that. 


e Volume 2 will deal with the emergency response to the Attack. It will examine 
the planning and preparation by the responders to an attack of the type which 
took place. It will look at what happened once the bomb had been detonated and 
how the response unfolded. | will assess the adequacy of the response. | will also 
examine in Volume 2 the circumstances of the death of each of those who lost their 
lives and whether any of their lives might have been saved. In that part of my Report, 
| hope to convey something of the uniqueness of each of the twenty-two who died: 
their personalities, their passions and the joy they brought to their families. The Pen 
Portraits given during the commemorative hearings at the beginning of the oral 
evidence were an extraordinary and moving start to this Inquiry. | will attempt to 
capture some of this. 


e Volume 3 will consider whether the Security Service and Counter Terrorism Police 
could and should have prevented the Attack. It will examine whether and, if so how, 
SA became radicalised. It will set out the steps which led to him being outside the 
concert with an improvised explosive device and what opportunities there may have 
been to disrupt, deter or divert him. 


Preface 


Finally, | wish to acknowledge, albeit briefly at this stage, my admiration for those who 
responded so selflessly and heroically to this atrocity. Some who did so were injured 
themselves. | shall address this in more detail in Volume 2, but it should be known 
from the outset of my Report that | have read and heard of extraordinary bravery and 
compassion by very many people. Together with the names of the twenty-two who 
died, the very best of humanity shown that night by so many people should never 

be forgotten. 
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1.1 In Part 1, | use the phrase missed opportunity to indicate where | am satisfied 
that there was an opportunity to act that should have been taken. 


1.2 The security arrangements for the Manchester Arena (the Arena) should have 
prevented or minimised the devastating impact of the Attack. They failed to 
do so. There were a number of opportunities which were missed leading to 
this failure. SA should have been identified on 22"¢ May 2017 as a threat by 
those responsible for the security of the Arena and a disruptive intervention 
undertaken. Had that occurred, | consider it likely that SA would still have 
detonated his device, but the loss of life and injury is highly likely to have 
been less. 


1.3 At the time of the Attack, the Arena was operated by an organisation which | will 
refer to as SMG.* SMG is a large entertainment business. SMG had contracted 
with Showsec, a company specialising in crowd control, to provide crowd 
management and event security for the concert on 22"? May 2017. Policing for 
the Victoria Exchange Complex,” including the area in which the Attack was 
carried out, was provided by British Transport Police (BTP). Greater Manchester 
Police (GMP) provided a Counter Terrorism Security Advisor (CTSA) to SMG who 
had provided advice to SMG in the years leading up to the Attack. 


1.4 SMG, Showsec and BTP are principally responsible for the missed opportunities. 
Across these organisations, there were also failings by individuals who played a 
part in causing the opportunities to be missed. 


1 Further detail about SMG, the companies which fall within it and the corporate structure will be dealt with in Part 2 


2 What is meant by the Victoria Exchange Complex and other important locations from an Arena security perspective 
are identified in Appendices 6 and 7 
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1.5 


1.6 


During the evening of 22"¢ May 2017, the Arena was the venue for a concert 

by Ariana Grande, an American singer with a large fan base. The concert was 
attended by over 14,000 people, many of whom were teenagers and children. 
The doors opened at 18:00 and Ariana Grande was scheduled to begin 
performing at 21:00.° Shortly before 22.30, the concert began to draw to a close 
and people started to leave. Many did so through an area called the City Room* 
which was one of the four customer access points into the Arena. There were 
people waiting close to the exit from the Arena concourse for friends and 

family who had attended the concert. This included many parents waiting to 
collect children. 


SA had carried out hostile reconnaissance? of the Arena shortly after the doors 
opened. He then returned to the Victoria Exchange Complex once the concert 
was underway.° He spent 20 minutes in a CCTV blind spot (the Blind Spot) on 
the mezzanine. The Blind Spot was between the entrance to JD Williams and 
the former location of McDonald's.’ Figure 1 is an annotated plan drawing of the 
City Room edged in green, with the mezzanine marked in yellow. The entrance 
to JD Williams and the former location of McDonald's are also indicated. 


5 INQOO1567/2 
4 |n the course of the evidence this area of the Victoria Exchange Complex was also called “the City Rooms" and “the 
foyer.” In my Report, | will use ‘the City Room.’ 


5 Aterm | shall define in paragraph 1.8 below 
© INGO20160/92, 1/58/2-23 


7 INQO32038/25 
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Figure 1: Annotated plan drawing of the City Room® 


L7 As well as being hidden from the CCTV cameras, SA was out of view of Showsec 
staff who were on duty in the City Room. He left this hiding place and the City 
Room, but did not leave the Victoria Exchange Complex. After a short time, he 
returned to the City Room and hid in the Blind Spot again, this time for almost 
an hour.’ After his return, members of the public saw SA in the City Room and 
thought he looked suspicious. One raised his concerns with a member of the 
Showsec security staff, but no effective action was taken in response.*° As 
people began to come out of the Arena into the City Room, SA descended from 
the mezzanine and detonated the bomb he was carrying. The details of these 
events are set out in the chronology in Appendix 2. 


8 Annotated extract from INQ035294/1 
2° INQO32038/33-35 
1 INQO32038/40-41 
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1.8 ‘Hostile reconnaissance’ is the term used within policing and the security sector 
to describe observation of a specific target by terrorists or other criminals as 
part of the planning of a hostile act on that target." 


1.9 Between 15" April 2017 and 18% May 2017, SA was in Libya. On 18 May,” 21% 
May* and on the afternoon of 22°% May 2017," SA visited the Arena to carry out 
hostile reconnaissance. The times SA visited on these occasions are set out in 
greater detail in the chronology at Appendix 2. These presented opportunities 
to detect, disrupt or deter him. Because the CCTV was overwritten, it is 
not possible to know whether SA visited on earlier occasions prior to 
15% April 2017. 


1.10 SA’s hostile reconnaissance was conducted at times and in a way which made 
detecting him a substantial challenge. At these times, he was not carrying his 
large backpack containing the bomb. Given the extent of the challenge, | make 
no criticism of any individual for not having detected his hostile reconnaissance 
on those occasions, particularly bearing in mind the security systems in place at 
the time. 


1.11 There existed the opportunity for SMG to make hostile reconnaissance more 
difficult for SA during events by pushing out the security perimeter of the 
security operation. This could have been a missed opportunity, depending 
on how the new security perimeter operated. It may have had the effect of 
deterring SA from attacking the Arena. | shall address the issue of the security 
perimeter in greater detail in Part 6. 


1.12 Setting aside the issue of the perimeter, had things been done better by SMG 
and Showsec, and had BTP officers been more alert to the possibility of hostile 
reconnaissance, the prospect of detecting it would have been increased. | will 
address these weaknesses in Parts 6 and 7. 


M1 15/182/15-21 
2 INQO31275/35-42 
13 INQO20163/51-57 
* INGO20160/47-53 
18 45/104/10-18 
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1.13  SA’s movements within the Victoria Exchange Complex are set out in Figure 2. 


1.14 During the period between 20:30 and 20:51 he moved from the tram stop to 
the City Room, stopping for a period of 12 minutes in public toilets en route. 
This movement is shown by the red line in Figure 2. 


1.15 He spent the period between 20:51 and 21:10 in the City Room on the mezzanine. 
At 21:10 he left the City Room and made his way back to the tram platform, where 
he arrived at 21:13. This movement is shown by the green line in Figure 2. 


1.16 At 21:29 he began his final journey to the City Room, where he arrived at 
21:33. He positioned himself on the mezzanine. At 22:30 he descended 
from the mezzanine. At 22:31:00% SA detonated the bomb he was carrying. 
His movements during this period are marked by the yellow line in Figure 2. 


F <i 
22 May 2017 Ce 
ee 


20:30 — 22:30 


f comm 5 - Not seen 
Start: 21:33 
Tram \ y Dee Finish: 22:30 
Walk - Platform to Toilets to City Room | \ 2 ie 
3, Walk — City Room to Platform ) | ot &) . 
| Walk — Platform to City Room Nees & Gy ie ou Z 
Confirmed Route (solid line) tata | . 4,5 oY 3 -Not seen 
== Assessed Route (dotted line) 6 - Bomb detonation | e NaS <I Start: 20:51 
net TW 22:30 AREN \QK\ Gane Finish: 21:10 
as y BOX OFFIC eB) my \ WT , 
Salman ABEDI’s movements inside Ves Sg L/ J 
Manchester Victoria/Arena have been split in y dD ee os ~ A J J 
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leg is yellow. This is for visual representation ‘ = Pa 41 - Tram 
tes] purposes only. ce. She Disembark: 20:30 
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Figure 2: SA’s movements on 22™ May 2017 from 20:30” 


1.17 | will now consider each time period in more detail. 


16 Figure 2 indicates that the bomb detonation occurred at 22:30. | am satisfied on the evidence that this occurred at 
22:31:00 


7 Extract from INQ033893/7 
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SA walking from the tram stop to the City Room 


1.18 At 20:30 on 22"¢ May 2017, SA arrived at Manchester Victoria tram stop. He was 
carrying the backpack which contained the bomb. He walked from there to the 
male toilets on the Victoria Station concourse. After a short period in the toilets, 
he made his way to the City Room using the station concourse lift. 


1.19 During this journey he walked past two BTP Police Community Support Officers 
(PCSOs) and two members of Showsec staff. These were further opportunities 
during which he might have been detected. He was visibly weighed down by 
his backpack, which weighed in excess of 30kgs.1® He was over-dressed for the 
warm evening. He was wearing a hat. These facts in combination are likely to 
have struck an appropriately trained person as being of potential significance, 
if they noticed him. That is not the same thing as saying that SA’s appearance 
meant that he should have been noticed. The Victoria Exchange Complex was 
far from empty of other people. It was a transport hub with a railway station, 

a tram stop and a car park. Having some sort of heavy bag was not unusual in 
itself even in combination with wearing too many clothes and a hat. 


1.20 ‘It is easy with the benefit of hindsight to see the images of SA anywhere in 
the Victoria Exchange Complex while wearing the backpack and conclude 
that his appearance made him suspicious. Stripping out hindsight, while it is 
possible that an appropriately trained and vigilant person may have reached that 
conclusion on the basis of his appearance, | do not think that it Is fair to criticise 
anyone who did not do so at this stage. 


1.21 Consequently, | do not criticise the BTP PCSOs who walked past SA on the 
station concourse for not identifying him as being suspicious at that point. 
Nor do | criticise the Snhowsec staff who were on the footbridge which gave 
access from the station concourse to the City Room for the fact that neither 
of them noticed SA when he passed them on his way to the City Room. 
While these were opportunities, they were not missed opportunities in the 
sense in which | mean that phrase. 


18 44/110/21-111/8 
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SA's first period in the City Room 


1.22 This period represents SA's first visit to the City Room wearing his backpack. 
The fact that SA was permitted to wait for any period of time in the City Room 
immediately prior to and during the concert was the product of the positioning 
of the perimeter. Had the perimeter been moved away from the Arena, SA 
would not have been able to gain access to the City Room. Whatever reason SA 
gave for going into the City Room, his backpack would have been searched. 


1.23. Showsec employee Mohammed Agha was present in the City Room at 20:51 
when SA entered it for the first time on 22"° May 2017. He had been deployed to 
the City Room to stand in an area known as ‘the Grey Doors’ for the duration of 
the event. As SA approached the McDonald's side staircase of the mezzanine, 
Mohammed Agha noticed SA's trainers because he liked them, but thought 
nothing more about him.’® SA was in Mohammed Agha’'s view for fewer than 
10 seconds. During that period there was nothing sufficiently suspicious 
about SA's appearance or the circumstances to justify criticism of the fact that 
Mohammed Agha did not take any further action at that time. 


1.24 SAremained in the City Room, out of sight of Mohammed Agha, on the 
mezzanine. The area where SA positioned himself was out of sight of the CCTV 
cameras. He had no doubt identified this area during his hostile reconnaissance. 
SA chose an obvious hiding place and remained in it for a period of nearly 
20 minutes. Had the area been covered by CCTV so that there was no Blind 
Spot, it is likely this behaviour by SA would have been identified as suspicious by 
anyone monitoring the CCTV. Once some scrutiny was on him, it is likely that 
SA's backpack, hat and bulky clothing would have heightened the suspicion. | 
shall address the issue of CCTV monitoring in greater detail in Part 6. 


1.25 This period was not a time that was obviously significant in terms of the risk of a 
terrorist attack. The concert was some way from finishing and very few people 
were in the City Room. Consequently, it is likely that there would have been a 
period of time before SA was identified as suspicious and a decision taken that 
he should be spoken to. | am not able to say, therefore, with any certainty that 
he would have been approached and, by reason of this, made aware that he had 
been identified during this period. 


1.26 However, had the CCTV system covered the Blind Spot and been properly 
monitored, there would have been heightened sensitivity to SA’s presence. 
His return to the City Room at 21:30 would then have been seen as significant 
by those responsible for monitoring the CCTV. | shall address CCTV and the 
Blind Spot in greater detail in Part 6. 


19 24/19/15-24/2 
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BTP officers in the public area of the Victoria Exchange Complex 


1.27 


1.28 


1.29 


BTP had deployed officers to police the Ariana Grande concert. They had 

been expressly briefed to stagger their breaks during the concert and to have 
concluded them by 21:00. This was a sensible instruction in light of the number 
of people, including young people, attending the concert who needed to exit 
the venue safely. This instruction was ignored by the officers who were present 
in the Victoria Exchange Complex. SA left the City Room at 21:10 and made 

his way via the station concourse to a tram platform. He waited there for a 
short period before making his way back to the City Room by the same route. 
He re-entered the City Room at 21:33. 


Because the BTP officers had ignored the instruction they had been given, 
there were no BITP officers in any of the public areas of the Victoria Exchange 
Complex during the period of SA's departure from and return to the City 
Room between 21:10 to 21:33. Had there been, it is possible that SA may have 
been seen by one or more BTP officers. This will be dealt with in further detail 
in Part 7. 


It is also possible that a visible policing presence would have deterred SA, but 
this is no more than possible. | do not regard this as a missed opportunity in the 
sense that | mean that phrase. SA had been undeterred by the two PCSOs he 
had walked past earlier. 
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SA‘s second period in the City Room 


1.30 


1.31 


1.32 


1,33 


1.34 


1.39 


What | have said about the security perimeter in the paragraphs above applies 
equally to SA's return to the City Room at 21:33. 


SA‘s return presented an opportunity for him to be identified as suspicious by 
Mohammed Agha. The fact that SA had been there previously was a factor 
which should have caused Mohammed Agha to pay him greater attention. 

SA followed the same path in the City Room as earlier in the evening. He again 
concealed himself on the mezzanine in the Blind Spot. Had Mohammed Agha 
been more alert to the risk of a terrorist attack, he had a sufficient opportunity 
to form the view that SA was suspicious and required closer attention. 

This conclusion, had Mohammed Agha been adequately trained, would have 
caused him to draw SA to his supervisor's attention at this stage. This, in turn, 
would have brought into sharp focus that SA had chosen to position himself out 
of sight of the cameras. 


This was a missed opportunity. Had this opportunity not been missed, it is likely 
to have led to SA being spoken to before 21:45. Had SA been spoken to at this 
stage he may have been deterred. He may have detonated his device. He may 
have left the City Room for a period, before attempting to return later. None of 
these possibilities is likely to have resulted in devastation of the magnitude 
caused by SA at 22:31. 


Principal responsibility for this missed opportunity lies with Showsec, who failed 
adequately to train Mohammed Agha. Mohammed Agha also bears personal 
responsibility for this missed opportunity. | will address the issue of Showsec’s 
training in greater detail in Part 6. 


At the same time, SMG's inadequate CCTV system was the cause of a different 
but connected missed opportunity. Had the Blind Spot been eliminated either 
by increased CCTV or by patrols, SA's activity would have been identified. 

This would have led to a similar course of events as if Mohammed Agha had 
drawn attention to SA. This was an ongoing missed opportunity for the whole of 
the period 21:33 to 22:00. 


By 22:00, SA's presence on the mezzanine had been noticed by members of the 
public. One of those members of the public was Julie Merchant who was in the 
City Room that night as part of an anti-bootlegging operation.”° Julie Merchant 
asserted that she had drawn SA to the attention of BTP Police Constable (PC) 
Jessica Bullough, although not because she thought SA was suspicious. 

PC Bullough stated that she had no recollection of any conversation of the type 
reported by Julie Merchant.*4 The City Room CCTV recorded Julie Merchant 


20 20/72/24-73/2 
at 21/172/8-24 
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and PC Bullough at 21:59 near the doors which provided direct access to 
the station concourse.” The two were in close proximity for only a couple 
of seconds. 


1.36 Julie Merchant stated that she did not regard SA as being suspicious.” 
Her recollection about what she said was, for understandable reasons, not 
clear, but she was not seeking to raise a security concern.” It is entirely 
understandable that PC Bullough did not take any action at this time. | do not 
regard this as a missed opportunity. 


22 20/106/1-15, INQ035314/29-34, INQ036597/1 at 2:52:12 to 2:56:02 
23 20/91/19-92/7 
24 20/114/8-120/11 
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BTP and the City Room in the 30 minutes before the end of 
the concert 


1.37. The BTP officers who attended the Victoria Exchange Complex on the evening 
of 22"7 May 2017 were there because of the concert. They were instructed by 
the duty sergeant that at least one of them should position themselves in the 
City Room from approximately 22:00 in readiness for the end of the event 
at 22:30. 


1.38 Five officers were instructed to attend. One of those officers, the most 
experienced, PC Stephen Corke, did not attend the Victoria Exchange Complex 
at all until after the detonation. PC Bullough, together with PCSO Mark Renshaw 
left the City Room at 21:59. Neither of them returned until after the explosion. 


1.39 There were two other PCSOs deployed to the Victoria Exchange Complex that 
evening: PCSO Jon Morrey and PCSO Lewis Brown. PCSO Brown was PCSO 
Morrey’s mentee and had to remain with him. Both had been in the City Room 
during the course of their deployment. Neither was in the City Room at any 
point during the period 22:00 to 22:31. 


140 Asaresult, there were no BIP officers in the City Room during the period 22:00 
to 22:31. There should have been at least one. Responsibility for this failing lies 
with PCs Bullough and Corke and PCSOs Renshaw and Morrey. They share this 
responsibility with BTP as an organisation. | will address this is in greater detail 
in Part 7. 


1.41 The mere presence of a BIP officer in the City Room may have deterred SA 
from mounting any attack, although | consider this unlikely. A BTP officer in the 
City Room may have identified SA as requiring investigation. PC Corke routinely 
positioned himself on the mezzanine.” In any event, all BTP officers should 
have been vigilant. The concert was shortly to end. SA's age meant that he 
did not fit the demographic of a parent waiting for a child. While SA may have 
been a sibling or friend of an attendee, his age was a further piece of relevant 
information when considering whether or not his presence at that stage of the 
evening was suspicious. This, added to his clothing, backpack and where he had 
chosen to position himself on the mezzanine, would have resulted in him being 
identified by a vigilant BTP officer, had such a person been present from 22:00. 


1.42 | will consider what might have occurred had SA been identified by an 
adequately vigilant BTP officer in the City Room at the conclusion of Part 1. 


25 21/9/11-24 
26 21/16/19-17/2 
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Showsec’'s pre-egress check 


1.43 


1.44 


1.45 


1.46 


1.47 


A further missed opportunity during the period 22:00 to 22:30 arose from the 
absence of an adequate security patrol by Snhowsec at any stage during this 
time. Showsec operated a system of “pre-egress” checks. Such a check was 
carried out by Showsec supervisor, Jordan Beak. An adequate security patrol of 
the whole City Room would have included a counter-terrorism element on the 
mezzanine. The pre-egress check was not an adequate security patrol. It should 
have been. 


Jordan Beak’s pre-egress check took place between 22:09 and 22:18. 

It included walking through the City Room.*’ Jordan Beak’s understanding 

was that this check included a counter-terrorism element, but the focus 

was on ensuring the egress routes were clear.2® The CCTV footage showed’? 
and Jordan Beak accepted, that he looked towards the staircases up to the 
mezzanine area only very briefly at 22:09 and 22:17. He did not consider them a 
very important part of the check because it was not an egress route.*° 


Jordan Beak did not go up on to the mezzanine area and so he did not see 
SA. This was a significant missed opportunity. Had Jordan Beak gone up onto 
the mezzanine, he would have seen SA. For the reasons | have identified, the 
circumstances would have resulted in SA being identified by an adequate 
pre-egress check as being suspicious. This, in turn, would have prompted 
further action which | will consider in detail at the conclusion of Part 1. 


| accept that Jordan Beak was simply following the training he had been given 
in relation to the pre-egress check. Principal responsibility for this missed 
opportunity lies with Showsec. However, SMG does bear some responsibility 
as well. 


| will address the issue of patrols in more detail in Part 6. 


Christopher Wild's report to Mohammed Agha 


1.48 


At 22:15, an event occurred which exemplifies the need for a BTP officer to have 
been in the City Room from 22:00. Christopher Wild was present in the City 
Room with his partner Julie Whitley. They were waiting to pick up Julie Whitley's 
daughter and her friend. At 22:12 they saw SA seated on the mezzanine. They 
could not understand why he was there and why he appeared to be hiding. 
Christopher Wild asked SA what he had in his bag and he did not reply in any 


27 INQ036729/132-136, INQ036729/156-158 


28 23/148/13-23 
29 INQ100000/1 at 1:42:32-1:43:13 
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meaningful way. Christopher Wild was concerned that the bag might contain a 
bomb. Figure 3 shows an area of the mezzanine between the JD Williams’ side 
and McDonald's side in which SA was hiding when seen by Christopher Wild. 


fea 


FY JD Williams entrance 


Figure 3: Location of SA when seen by Christopher Wild (marked with an X)*% 


1.49 


1.50 


Christopher Wild was not the only member of the public who thought that SA 
appeared to be out of place at that time.** He was, however, the only person 
who acted. The fact that SA was noticed by members of the public supports the 
conclusion that a vigilant BTP officer or Jordan Beak would have identified SA as 
suspicious, had they seen him. 


Christopher Wild reported his concerns to Mohammed Agha at 22:15.% 
Mohammed Agha’s response was that he already knew about him. 

Christopher Wild felt he had been “fobbed off’.3° Another member of the public, 
Thomas McCallum, who overheard the conversation, thought Mohammed Agha 
was “really quite dismissive."*’ 


32 22/35/1-41/25 
33 Annotated extract from INQO023234/2, with the location of the X marked by Christopher Wild highlighted by the 


circle 


34 18/67/4-10, 22/159/8-15, 21/112/24-113/20 
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1.51 


1.52 


1.53 


1.54 


Mohammed Agha stated that when Christopher Wild told him of his concern, 

it took him some time to realise that he was talking about the same person that 
he had seen go up to the mezzanine area on two occasions.*® He stated he did 
tell Christopher Wild not to worry as he did not want him to be concerned and 
worry other people. Mohammed Agha denied fobbing Christopher Wild off.*? 
Whether it was Mohammed Agha’s intention or not, the effect was to fob 
Christopher Wild off. 


Mohammed Agha knew that he should report what he had been told to a 
Showsec supervisor or a member of Showsec staff who had a radio.*° He saw 

a senior supervisor, David Middleton, over by the doors to the Arena in the 

City Room less than 30 metres away“! and he stated he tried to call him over.*@ 
The CCTV reveals some very modest movements by Mohammed Agha which 
do, to some extent, support his account. For that reason, | am prepared to 
accept that Mohammed Agha did make some effort to contact David Middleton. 
The effort he did make was, however, inadequate. 


Mohammed Agha should have done more immediately following his 
conversation with Christopher Wild. This was a missed opportunity. Mohammed 
Agha did not respond appropriately because he did not take Christopher Wild's 
concerns as seriously as he should have. Responsibility for this rests on both 
Mohammed Agha and Showsec. | will address the reasons for this further in 

Part 6. 


At this point in the events, the concert was not due to finish for another 

15 minutes. This was a sufficient period of time both for an investigation of 
Christopher Wild’s concerns and for decisive action to be taken by those in 
charge of the event. | will deal with what could have been done in more detail at 
the conclusion of Part 1. 


Mohammed Agha’s report to Kyle Lawler 


1.55 


A further opportunity for Mohammed Agha to respond to Christopher Wild's 
concern presented itself at 22:22. Kyle Lawler, another Showsec employee, 
walked across the City Room and was called over by Mohammed Agha. 

Unlike Mohammed Agha, Kyle Lawler had a radio. Mohammed Agha told him 
what Christopher Wild had said and they both said that they then went to look 
at SA. Kyle Lawler stated that at first he was not suspicious about SA but he did 
think there was something wrong.*’ He said that SA appeared to have a slightly 
nervous reaction to being looked at and seemed fidgety.** Kyle Lawler felt 


38 24/31/19-32/4 
3° 24/102/17-103/21 
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conflicted about what to do as he had heard nothing of any potential attack. 
He stated he was fearful of being branded a racist and would be in trouble if he 
got it wrong.*° 


| accept that Kyle Lawler did try and get through on the radio, but someone else 
was talking and he was unsuccessful. He said he tried to get through a number 
of times before returning to the raised walkway.*° 


There was evidence that the radio traffic could be busy about the time that 

the concert was coming to an end, but the weight of the evidence was that a 
member of the Showsec staff would not have to wait more than a couple of 
minutes before getting through.*” While Kyle Lawler did make some effort to 
get through, | do not consider that his efforts were adequate. If he believed he 
could not get through on the radio, he could have reported what he had been 
told to senior supervisor David Middleton. Instead, within minutes of having first 
spoken to Mohammed Agha, Kyle Lawler had left the City Room and made no 
further efforts to communicate what he had been told to anyone else. 


In Figure 4, Kyle Lawler can be seen on the raised walkway. The image Is taken 
approximately 30 seconds after he had finished speaking to Mohammed Agha. 
His body language as he walked away from the City Room indicates that he was 
by that stage unconcerned. 


SRN-1000_192.168.1.200:554/SRN-1000_192.168.1.200:554-Cam07 
2017-05-22 21:21:44 4 


Figure 4: Kyle Lawler (in the yellow box) at 22:25:46 on the raised walkway*® 


4 25/112/12-114/2 
46 25/115/13-117/21 
47 17/213/24-214/9, 19/97/5-10, 23/30/2-7, 23/165/5-168/21, 34/150/19-22 
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1.59 


1.60 


1.61 


1.62 


This was another missed opportunity. The inadequacy of Kyle Lawler’s response 
was a product of his failure to take Christopher Wild's concern and his own 
observations sufficiently seriously, as was the case for Mohammed Agha. 
Responsibility for this rests on both Kyle Lawler and Showsec for reasons | 

will explain. | accept that having spoken to Kyle Lawler, Mohammed Agha was 
entitled to rely upon him as a radio holder to communicate Christopher Wild's 
concerns from that point. 


As indicated above, at the conclusion of Part 1, | will consider what the effect of 
an adequate and timely report by Kyle Lawler would have been. 


The concern raised by Christopher Wild is relevant to BTP as well as Showsec. 
Had there been a BTP officer in the City Room after 22:00, Christopher Wild 
could have reported his concern to that officer instead of to Mohammed Agha. 
Christopher Wild said that he would have taken this option if it had been 
available. If this had occurred, a competent BTP officer would have taken action 
that could have saved lives. 


A BTP officer would also have been available for Mohammed Agha to report the 
concern to. This is less likely to have happened, given that Mohammed Agha did 
not take Christopher Wild's concern sufficiently seriously. 
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1.63 


1.64 


1.65 


1.66 


It is difficult to reach a safe conclusion on what the consequences of the missed 
opportunities were, if any. No-one knows what SA would have done had he 
been confronted before 22:31. We know that only one of the twenty-two killed 
by SA entered the City Room before 22:14. Eleven of those who were killed 
came through the Arena concourse doors into the City Room after 22:30. | will 
deal with the detail of these timings in Volume 2. 


If a BTP officer had been present in the City Room from 22:00 onwards, 
Christopher Wild would, he said, have approached that person instead of 
Mohammed Agha.’? It is likely that a BTP officer would then have spoken to SA. 
PC Bullough confirmed that had a member of the public raised a concern about 
a suspicious person with a backpack she would “definitely” have approached 
that person.°° | have considered whether this statement was a product of guilt 
born of hindsight. Having heard her give evidence, | have no reason to doubt 
that her evidence about this was correct. An approach by a police officer may 
have caused SA to leave the City Room, or he may have detonated his device. 

In either case, it is likely that fewer people would have been killed. 


Had Mohammed Agha or Kyle Lawler reported the presence of a suspicious 
individual in the City Room, Miriam Stone, SMG Event Manager that night, stated 
that she could, within minutes, have prevented the audience exiting into the City 
Room. This would have been done by closing the exit doors and diverting the 
audience through other exits.°* James Allen, SMG’s Arena Manager, agreed and 
thought it would take in the “single figures” of minutes to achieve this.°? 


This step would not have taken place immediately. The procedure which would 
have been followed, is that the Sierra Control Room would have asked for the 
CCTV camera to be turned to focus on SA's position. Had it become clear he 
could not be seen, this may have caused further concern and led to the City 
Room doors being closed for egress at that stage. Alternatively, the Sierra 
Control Room may have asked a Showsec supervisor, most likely to have been 
David Middleton, to go and observe SA. David Middleton's evidence was that he 
would have considered someone loitering in the City Room with a big backpack 
suspicious and reported this to the control room,** which would also have led to 
the City Room doors being closed for egress.°* Had the City Room doors been 
closed for egress, it is highly likely that the number of casualties would have 
been fewer. 


49 22/48/15-23 
5° 21/185/22-196/15 
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1.67  Inany event, none of these processes would have taken long, probably fewer 
than five minutes and very likely less than 10 minutes given the evidence of 
James Allen and Miriam Stone. If Mohammed Agha had reported Christopher 
Wild's concern immediately to David Middleton at 22:15, these steps would have 
been taken before SA moved off the mezzanine area. If Kyle Lawler had reported 
SA's presence over the radio immediately at 22:23, it is also likely that these 
steps would have been taken before SA moved towards the doors. Events would 
then have developed very differently, although it is impossible to be certain what 
the final outcome would have been. 


168  |am satisfied that there were a number of missed opportunities to alter the 
course of what happened that night. More should have been done. The most 
striking missed opportunity, and the one that is likely to have made a significant 
difference, is the attempt by Christopher Wild to bring his concerns about 
SA, whom he had already challenged, to the attention of Mohammed Agha. 
Christopher Wild's behaviour was very responsible. He stated that he formed the 
view that SA might “let a bomb off’.°° That was sadly all too prescient and makes 
all the more distressing the fact that no effective steps were taken as a result of 
the efforts made by Christopher Wild. 


88 22/37/23 
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The Arena was opened in 1995. It is situated to the north of the city centre in 
Manchester. Its footprint lies above Manchester Victoria Railway Station and it 

can be accessed from the station concourse via a raised walkway. The freehold 
interest in the Victoria Exchange Complex is held by Network Rail. Between 2013 
and 2018, Mansford LLP (Mansford) held a lease for the Arena. Mansford sublet the 
Arena and had no involvement in the day-to-day management. | shall deal further 
with the sub-lease granted by Mansford to the Arena operator, SMG, below. 


The Arena is one of the largest and busiest indoor arenas in Europe, with a 


maximum capacity of 21,000.°° 
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Figure 5: Plan view of the Victoria Exchange Complex°’ 
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2.3 


2.4 


Figure 5 shows the layout of the Victoria Exchange Complex. The City Room 
can be seen to the left of centre. One of the main Arena entrances opens 

out into this space, providing access to the NCP car park, Trinity Way via a 
pedestrian tunnel and the railway station and tram platform via a raised walkway. 
For these reasons, It is a popular location for people to wait to pick up attendees 
at the end of an event.°8 


On the opposite side of the City Room from the Arena doors, there are stairs up 
to the mezzanine. This is where SA waited before walking down the stairs and 
towards the Arena doors, where he detonated his bomb. Figure 6 shows a view 
of the mezzanine level from the main floor of the City Room. 


A a 


JD Williams entrance 


=~ 


| Raised area above the 
‘Grey Doors’ exit 


Figure 6: View of the mezzanine from the main floor of the City Room*? 


25 


At the top of the flight of stairs, on the left in Figure 6, is the entrance to 

JD Williams. At the top of the flight of stairs on the right is the former location 
of McDonald's. In order to distinguish between the two sides of the mezzanine 
| will refer to the ‘JD Williams’ side’ and the ‘McDonald's side’ by reference 

to these two locations. | will take the same approach when identifying the 

two staircases which lead up to each of these areas. Behind the raised 

area, above the Grey Doors exit between the staircases, is a corridor space. 
This connects the JD Williams’ side of the mezzanine with the McDonald's side 
of the mezzanine. 


58 1/22/11-23/2 
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2.6 Figures 7 and 8 show the City Room empty and with people queuing to enter 
the Arena. These photographs were not taken on 22% May 2017. Behind the 
position from which the photograph in Figure 7 was taken is the McDonald's 
side of the mezzanine, near the doors to the raised walkway. The photographer 
of Figure 8 was standing on the JD Williams’ side of the mezzanine. 


EXTRA DATE ADDED. 
DUE TO PHENOMENAL DEMAND 
FRI 03 JUNE 
MANCHESTER ARENA 


UK | EVENTIM.CO.UK 


oors leading to the Arena concourse 


Doors leading to the Victoria Station 
concourse via raised walkway 


Figure 7: The City Room viewed from near the doors to the raised walkway®? 
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Arena box office 
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Figure 8: The City Room viewed from the JD Williams side of the mezzanine 


Z./ The City Room, as an area outside an event site to which the public had 
access, is an example of what Colonel Richard Latham and Dr David BaMaung, 
the Security Experts instructed by the Inquiry, described as “grey space”. 

This is a space where there is a lack of clarity over ownership or where various 
neighbours, partners or tenants have responsibility for security.® The City 
Room is part of the Victoria Exchange Complex, but not within the Arena itself. 
Except between 00:00 and 05:30, the public had access to it at all times, 
including during events. Employees and customers of the other businesses 
within the Arena complex came and went through it. 


2.8 There were two control rooms within the Arena: Sierra Control and Whisky 
Control. Sierra Control was only used for events. Whisky Control was open 
24 hours a day, 7 days a week. | shall provide further detail about the relationship 
between these two control rooms in Part 6. 


2.9 There were three organisations or institutions in particular which had significant 
responsibility for security within the City Room: the owner and operator of the 
Arena, SMG; its crowd management and security subcontractor for events, 
Showsec; and the relevant police services, primarily BTP. | consider the extent 
of BTP’s responsibility and how well it was discharged on 22"? May 2017 in 
Part 7. The responsibilities of the private organisations are dealt with in further 
detail below. 


61 Annotated extract from INQ033848 
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Key findings 


For the purposes of the Attack, the two most important companies in the SMG 
group were SMG Europe Holdings Ltd and SMG (UK) Ltd. There was an unclear 
division of responsibility between these two companies. 


SMG Europe Holdings Ltd had undertaken to provide security in the City 
Room by reason of a facilities management agreement with its landlord. 
Security included patrolling and monitoring of CCTV. 


There is likely to have been a breach of the Security Industry Authority's (SIA) 
licensing regime in relation to CCTV operators by either or both SMG Europe 
Holdings Ltd and SMG (UK) Ltd. 


SMG had responsibility for the security of people in the City Room by reason of 
the facilities management agreement. It had a separate statutory duty to take 
such steps as were reasonably practicable to keep event-goers in the City Room 
safe from a terrorist attack. 


The SMG corporate structure 


2.10 


2.11 


In Part 1, | referred to SMG. While a convenient shorthand to cover more 

than one company which included SMG in its name, it is important that the 
legal position is set out. This is because there was an unclear division of 
responsibilities between two SMG named companies. The arrangement was 
sufficiently unclear to result in confusion in the minds of some SMG employees 
as to which company they worked for. It also created confusion which resulted 
in an incorrect belief that an SIA CCTV licence was not required for those 
monitoring the CCTV. 


SMQ's corporate structure at the time is set out in a document entitled “SMG 
Organizational Chart European Entities" as set out in Figure 9. 
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SMG Organizational Chart 
European Entities 


(U.K. Limited 
Liability Company) | 


| 
100% 100% 100% 


j 
soles abs 99.9% % 
| (Poland Company) (Turkey Company) weteitls 33) nlimited (YK Limited Beyercu tance ae) (Northern Ireland } (UK. Limited 
(U.K. Company) Liability Company) Liability Company) (Germany Corporation) Corporation) Liability Company) 
100% 50% 
SMG Science Center 
eosneaiallee Services , GmBH 
Liability Company) (Germany Corporation) 


100% 100% 


(U.K. Limited 


Liability Company) (U.K. Limited 


Liability Company) 


Figure 9: SMG Organisational Chart of European Entities — relevant companies 
highlighted 


2.12 The relevant parts of this structure, as they were arranged in 2017, were 
as follows. SMG was a Pennsylvania General Partnership. It was the parent 
organisation and was registered in the United States. | shall refer to it as SMG US. 


2.13. Beneath SMG US was SMG Europe Holdings Limited (SMG Europe Holdings). 
SMG Europe Holdings was wholly owned by SMG US and registered in 
the United Kingdom. SMG Europe Holdings owned a number of other 
UK-based companies. One of these was SMG Europe Limited (SMG Europe). 
SMG Europe was an intermediate holding company and is not named as a party 
to any of the agreements. 


2.14 SMG Europe owned SMG (UK) Limited (SMG (UK)). 


2.15 For the purposes of what occurred on 22 May 2017, the two most important 
companies in the SMG group were SMG Europe Holdings and SMG (UK). 
Between them, SMG Europe Holdings and SMG (UK) carried out the two parts of 
the SMG group's activity within the Victoria Exchange Complex. Those two parts 
were facilities management and the running of events.®° | accept that, at a senior 


64 Annotated extract of INQ038985/1 
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level, the intention was that SMG Europe Holdings would be responsible for 
facilities management and SMG (UK) would be responsible for events. This was 
not always borne out by what occurred. 


In this Report, when | refer to SMG, | am referring to the activities of these two 
companies. The evidence revealed there was an insufficiently clear distinction 
between the two of them for it to be appropriate, or on occasions possible, 

for me to identify one rather than the other. This was because of the contractual 
and employment arrangements which had been put in place by SMG. 


The approach | am taking by referring to two legal entities by the single name 
SMG reflects the reality on the ground in May 2017 in the minds of many who 
interacted with SMG. At a senior level in Showsec, for example, there was no 
clear understanding of the corporate structure set out above.°’ 


My approach is also consistent with the approach that SMG itself took 
during the Inquiry. Core Participant status in the Inquiry was held by SMG 
Europe Holdings.®® However, those representing SMG Europe Holdings, 
which of course owned SMG (UK), dealt with both the events and facilities 
managements side of the business. This was both an appropriate and 
pragmatic approach. 


SMG Europe Holdings 


The Arena lease and the facilities management agreement 


2.19 


2.20 


Mansford sub-let the Arena to SMG Europe Holdings. SMG Europe Holding’s 
lease was subject to a facilities management agreement.® In 2014 the rights 
and responsibilities under both agreements were transferred from SMG Europe 
Holdings so that they were jointly held by SMG Europe Holdings and SMG US. 
This was at the request of Mansford. This was not a change which the evidence 
suggested made any difference to the issues | am considering. 


The facilities management agreement is an important document. It states: 

“SMG will provide and operate a 24 hour a day, 7 day a week, security service”.”° 
Included within the security service was “Monitoring, operating and testing 

the security alarm, intruder detection, and security surveillance systems."” 

The security service also required “foot patrols of the building’? which would be 
recorded by “an electronic clocking system".’”* These electronically monitored 
foot patrols were referred to by SMG as “Deister Patrols.” This term was a 
reference to the equipment which was used.” 
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2.21 


The route of the Deister Patrols took in the mezzanine area in the City Room.” 
These patrols included a counter-terrorism element. They did not, however, 
take place during events. The facilities management agreement did not specify 
how many patrols would occur each day or at what time, but stated that 

‘all duties”, which included the foot patrol duty, “will be required on a 24 hour, 
7 day a week basis."’° 


Key employees of SMG Europe Holdings 


2.22 


2.23 


2.24 


225 


2.26 


2.27 


SMG Europe Holdings employed a number of key people so far as the events of 
22™ May 2017 are concerned. The Inquiry heard from each of them. 


In 2017, John Sharkey was the Executive Vice President of SMG Europe 
Holdings. He was responsible for 10 arenas operated by SMG Europe Holdings, 
including the Arena.” 


James Allen was the Arena General Manager. He joined SMG in 1998, having 
spent the three previous years working in the events industry.’”® He started 
working at the Arena in 2003.7 He became the Arena General Manager in 
2013.°° James Allen stated that he worked for SMG (UK).®* In fact he was 
employed by SMG Europe Holdings,®* but was paid by SMG (UK).% 


Miriam Stone was the Events Manager and on duty on 22" May 2017. She was 
also employed by SMG Europe Holdings™ and paid by SMG (UK).®° She worked 
for the events side of the business. She said of the relationship between SMG 
(UK) and SMG Europe Holdings, “/f I’m honest from where we were sitting there 
was... it didn't feel like a massively straightforward relationship."®° She went on to 
say that there was “some fuzzy crossover in that our offices were next door, so 
there'd be to-ing and fro-ing."®’ 


SMG Europe Holdings also employed Michael Edwards,®® who worked in 
Whisky Control as a Control Room Operator. Michael Edwards was one of three 
people in or around Whisky Control during the Ariana Grande concert. 


| will address the training of the relevant SMG Europe Holdings personnel 
in Part 6. 


® 26/194/8-23, 34/29/11-14 
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SMG (UK) 


Licence to occupy 


2.28 SMG Europe Holdings granted a contractual licence to SMG (UK) to occupy 
the Arena. Despite his seniority, Jonn Sharkey was not sure whether this grant 
had ever been reduced to writing. Consequently, the details of this contractual 
licence were not clear from the evidence. John Sharkey stated that there was a 
process of re-charging between SMG (UK) and SMG Europe Holdings, although 
SMG (UK) did not pay any rent to SMG Europe Holdings in order to occupy 
the Arena.®? 


2.29 This appears to me to have been an arrangement of convenience based on an 
informal understanding between two legal entities. This agreement was able 
to subsist because the legal distinction was not regarded as being sufficiently 
important, by those who put it into effect on the ground, for any lack of clarity 
to be regarded as problematic. 


2.30 John Sharkey denied the suggestion that the arrangement created confusion 
in practice.?° However, it did give rise to difficulties with the SIA licencing regime 
as | set out below. 


Premises licence 


2.31 The premises licence granted by Manchester City Council, which permitted 
events to be held at the Arena, was held by SMG (UK). James Allen, who 
was employed by SMG Europe Holdings, was named as designated 
premises supervisor.?? 


2.32 | will address the detail of the relevant parts of the licence and the licensing 
regime in Part 3. 


Key employees of SMG (UK) 


2.53 SMG (UK) employed Michael Cowley and Paul Johnson.%? Michael Cowley 
was the Facility Services Director.%? This meant he was in charge of the 
facilities management agreement. He was named as part of it.°* The facilities 
management agreement was signed on behalf of SMG Europe Holdings, 
not SMG (UK).%° In his statement John Sharkey incorrectly asserted that 
Michael Cowley and Paul Johnson were employed by SMG Europe Holdings.°° 
However, he corrected this when he came to give evidence.%” 
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2.34 


2.39 


2.36 


Michael Cowley gave evidence about the operation of the facilities management 
agreement. He stated that, during events, the SMG Deister Patrols would not 
take place®® and patrolling was carried out by Showsec.’? His evidence was 
contradictory and confusing about whether or not Showsec were discharging 
the facilities management agreement responsibility to patrol.t°° He appeared to 
settle on a position in which he thought Showsec had been retained by SMG to 
discharge the patrolling obligation.* 


Miriam Stone provided clarity on the point. She was clear, and | accept, that 
Showsec’'s operation was confined to the event which was taking place and 
had nothing to do with SMG Europe Holdings’ obligation to Mansford.*® It is 
of concern to me that the person in charge of facilities management, Michael 
Cowley, did not understand the correct position. 


Paul Johnson was the Security and Cleaning Supervisor.?°3 He had held that 
position since 2005. These roles fell into the facilities management side of 
SMG’s business.'™ He also acted as Fire Safety Officer on event days, including 
on 22" May 2017. He stated that he was employed by SMG Europe Holding? 
and had learned of SMG (UK) through listening to the Inquiry.?°° In fact and 
despite the belief he held, Paul Johnson was employed by SMG (UK), as John 
Sharkey was to confirm.*%” He stated that he had not realised that there was a 
split between facilities and events and that he worked as part of “a very close 
team."*°° | will address the issue of Paul Johnson's training in Part 6. 


Consequences of SMG's corporate structure 


ame ef 


The SIA regime only requires a person in a junior role to be licensed for CCTV 
monitoring into a public space if they are supplied under a contract for services. 
During the Ariana Grande concert, Paul Johnson and Michael Edwards both 
monitored the CCTV in Whisky Control. Neither had an SIA CCTV licence. 

One was employed by SMG Europe Holdings; one was employed by SMG (UK). 
At least one of them required an SIA CCTV licence, depending on whether at the 
time they were monitoring CCTV, they were doing so on behalf of SMG Europe 
Holdings or SMG (UK). James Allen's view was that the facilities management 
side of the business provided him with control room officers for events.’ If this 
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was what SMG was in fact doing, as was the case for at least Michael Edwards, 
he required an SIA licence for it to be permissible to monitor the CCTV during 
events. 


2.38 Part 3 will dealin greater detail with the SIA regime. In Part 6, | will deal with 
CCTV monitoring as a terrorism threat mitigation measure. 


Responsibility for people in the City Room 


2.39 There was a clear understanding at all levels of senior management within the 
SMG group” of its responsibility for the security of people attending events at 
the Arena, including in the City Room." In submissions to me, it was accepted 
on SMG's behalf that SMG was responsible for the security of people in the City 
Room."* SMG acted as though it was responsible’ and SMG was responsible. 


2.40 SMG had that responsibility for people in the City Room for two reasons 
arising from the two sides of its business. SMG was responsible under the 
facilities management agreement for the provision of security on the site, 
24 hours a day, 7 days a week. The City Room was included within this 
contractual responsibility. 


2.41 SMGalso had a responsibility for those attending events as the event operator. 
The City Room provided a key ingress and egress route into and out of the 
Arena and was used as an area in which people queued to buy tickets and 
queued to enter. That responsibility arose under section 3 of the Health and 
Safety at Work etc. Act 1974. This required SMG to conduct itself so as to ensure, 
so far as reasonably practicable, that persons who are not its employees who 
may be affected by its activities are not exposed to risks to their health and 
safety. Event-goers were undoubtedly persons who were affected by SMG’s 
activities. | shall address the health and safety regime in a little more detail 
in Part 3. 


2.42  Anissue arose during the Inquiry as to whether John Sharkey had told Figen 
Murray, the mother of Martyn Hett, that SMG was not responsible for the 
City Room. Figen Murray stated that John Sharkey had told her that “the area 
outside the Arena had nothing to do with SMG" during a meeting she had 
with him on 8 December 2017." John Sharkey stated on a number of 
occasions during his evidence that he had no reason to dispute Figen Murray's 
account"* although he also stated he could not remember the exact words 
he used."”” He asserted he was “definitely responding on the basis of not 


il 


ro} 


41/48/1-15, 41/22/5-9, 30/10/1-7 

28/7/22-24 

12/9/2-19 

43/196/24-197/1 

INQ022832/5, INQ022832/40-41, INQ022832/68 
32/182/21-23 

41/52/18; 41/59/8-22 

41/53/2-19 


iL 


ie 


AL 


i) 


alel 


a 


11. 


B 


AL 


a 


AL 


a 


i 


N 


39 


Manchester Arena Inquiry Volume 1: Security for the Arena 


describing the responsibilities.""® At one point in his evidence, John Sharkey 
said “/ dont think | said SMG are not responsible for security in the City Room" 
but then confirmed he was not disagreeing with Figen Murray's account.""? 

He categorically denied trying to avoid responsibility in the meeting.*7° 


2.43. He accepted that “it should have been fairly easy to describe 
the responsibilities." He offered Figen Murray an apology for not having given 
a clear answer and for the hurt he had caused.’”* He stated that it had not 
been his intention for her to leave the meeting with the impression she did.17° 
Figen Murray's account was not challenged by SMG.1*4 


2.44 Having heard from both Figen Murrary and John Sharkey, | have no doubt that 
John Sharkey said to Figen Murray words which carried the clear meaning that 
SMG was not responsible for security in the City Room. That was despite the 
fact that he knew in May 2017 that SMG was responsible for security in the City 
Room by reason of both the facilities management agreement and the duty 
towards event-goers.'*° | conclude that John Sharkey tried to mislead Figen 
Murray in a misguided attempt at ‘damage limitation’ for SMG. | am prepared to 
accept that it was a challenging meeting for John Sharkey.’#° However, it would 
have been a much more difficult meeting for Figen Murray, and John Sharkey 
should have given a straightforward and accurate response. 
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Key findings 


Showsec provided a crowd management and security service to SMG. Showsec 
had a counter-terrorism role to play at events as part of its crowd management 
and security role. 


Showsec had a responsibility to event-goers in the City Room to take such steps 
as were reasonably practicable to keep them safe from a terrorist attack. 


Showsec held itself out as having expertise in counter-terrorism when it came to 
its own activity. 


Key employees 


2.45 


2.46 


2.47 


2.48 


2.49 


2.50 
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In 2017 Mark Harding was the managing director of Showsec International 
Limited (Showsec). He started working for Showsec as a steward in 1987. 

He became managing director in 2003. He was one of four directors, one other 
of whom was Mark Logan.’*2” 


Mark Logan began working for Showsec in 1991 and became a director 
in 2007.78 One of his roles as director was as line manager for Showsec’s 
health and safety department.'29 


Thomas Bailey joined Showsec in 2005. He was a supervisor before becoming 
operations executive in 2011. From 2012, he was one of two heads of security 
Showsec provided to the Arena. In addition to this role, from 2015, he was the 
senior contracts manager for the Arena and was area manager for the part of 

the country which included the Arena.**° 


Thomas Rigby, who was on duty as Showsec head of security on 22™ May 2017, 
joined Showsec in 2007. He started acting as head of security for the Arena from 
2015 and was very experienced at undertaking this role.*** 


Between them, these four people had responsibility for making the key 
decisions on behalf of Showsec in relation to the matters relevant to the Inquiry. 
All of them were appropriately qualified and experienced in the roles that 

they undertook. 


Showsec has a casual workforce of approximately 4,000 people. 
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2.51 


2.52 


2.53 


2.54 
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On the night of the Attack the following people from Showsec, from whom the 
Inquiry heard, held significant roles at the Arena. 


David Middleton was the senior supervisor for the area which included 

the City Room. By the time of the Ariana Grande concert, he had 21 years’ 
experience working for Showsec.*** He had worked at the Arena very many 
times prior to 22™ May 2017.5 He held an SIA door supervisor's licence.** 


Daniel Perry and Jordan Beak each worked as ‘access control’ in the City Room 
on 22™ May 2017.*%° Both held SIA door supervisor licences.° Daniel Perry had 
worked for Showsec since 2013.1” Jordan Beak had worked for Showsec for 
approximately two years prior to the Attack.*%* | shall provide more detail in 
relation to SIA licences in Part 3. 


Mohammed Agha, who was 19 years old at the time of the Attack,’? was 
allocated to the Grey Doors in the City Room.”° This position required him to 
hold an SIA licence.**t Mohammed Agha held an SIA door supervisor's licence 
and had worked for Showsec at the Arena approximately 30 times prior to 

the Attack.’** He had started working for Showsec exactly one year previously." 
227 May 2017 was the first time Mohammed Agha had worked on the Grey 
Doors in the City Room." It was also the first time that Mohammed Agha had 
worked for Showsec as the holder of an SIA door supervisor's licence.**° 


Kyle Lawler and Robert Atkinson were deployed to the footbridge which gave 
access to the City Room from the station concourse. Kyle Lawler was 18 years 
of age.*° He had joined Showsec when he left school two years previously.*” 
His position required him to hold an SIA licence, which he did. Robert Atkinson 
held the position of steward, which did not require an SIA door supervisor's 
licence. Robert Atkinson had worked for Showsec for six months.¥8 


| will address the issue of the training relevant Showsec personnel had received 
in Part 6. 
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Agreement with SMG 


2.57. Showsec provides crowd management and stewarding services to events 
at SMG venues."*? It has worked with SMG since 1995.*° From 2012, the 
relationship was governed by a stewarding services agreement between 
Showsec and SMG Europe Holdings.*** This agreement was not specific 
to the Arena, but covered all venues operated by SMG to which Showsec 
provided staff.*? In May 2017, Showsec provided staff to eight SMG venues in 
the UK, of which the Arena was one.*°* 


2.58 Mark Harding was unaware that SMG Europe Holdings had obligations for 
security beyond events through the facilities management agreement.'** 
He stated that Showsec's role was to provide security and crowd management 
at events.?°° 


2.59 The stewarding services agreement does not expressly mention 
counter-terrorism at any point. However, it was accepted on Showsec's behalf 
that it did have a counter-terrorism role to play at events as part of its crowd 
management and security role. This included the Ariana Grande concert. | will 
deal with this in more detail below.*° 


2.60 While counter-terrorism services were not specified in the contract, Showsec 
did hold itself out as having expertise in counter-terrorism when it came to 
its own activity. The extent to which SMG was entitled to rely upon Showsec 
when it came to counter-terrorism was a contentious issue between the two 
organisations in the course of the Inquiry. | will return to this in Part 5 when 
considering the issue of specialist counter-terrorism input. 


Responsibility for people in the City Room 


2.61 During events, Showsec had a permanent presence of staff in the City Room. 
It was necessary and appropriate for it to do so. Thomas Bailey's evidence 
was that in delivering the stewarding services agreement between Showsec 
and SMG, part of delivering the security aspect of that agreement included 
counter-terrorism.’” He also accepted that Showsec had a responsibility to 
keep event-goers in the City Room safe from terrorists.°® He was correct to say 
both these things. 
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2.62 


2.63 


2.64 


2.65 


2.66 


In its written opening statement Showsec stated: “Showsec accepts that as 
part of its duties in providing “Stewarding and Event Services” it was required 
to identify the risks associated with terrorism, plan to mitigate those risks and 
implement that plan."1°° 


As an employer, Showsec had obligations under section 3 of the Health and 
Safety at Work etc. Act 1974. These were in the form of a duty to ensure, so 
far as was reasonably practicable, the health and safety of non-employees 
who may be affected by its activity. This obligation undoubtedly included 
event-goers, as Showsec accepted. 


In my view, taking together Showsec’s responsibilities under the contract and its 
duties under the Health and Safety at Work etc. Act 1974, Snhowsec had a duty to 
take such steps as were reasonably practicable to keep event-goers safe from 
terrorist attack. 


Unlike SMG, Showsec had not assumed a contractual responsibility for Keeping 
everyone in the City Room safe. However, the distinction between event-goers, 
those who were in the City Room to meet event-goers and people who 

were waiting or passing through is academic. The practical effect of Keeping 
event-goers safe would have been to keep everyone in the City Room safe. 


In describing the distinction as academic, | am making no comment on whether 
or not Showsec had a legal obligation to people in the City Room beyond 
event-goers. Whether the same duties extended to people in the City Room 
who were not attending an event is not something that | need to decide. 


159 INQ035495/6 at paragraph 4.7. See also INQ039377/10 at paragraph 25; INQ035495/2 at paragraph 1.12-1.13 
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2.68 


2.69 


2.70 


In the course of their questioning, representatives of the bereaved families 
asked questions about whether and if so, to what extent, SMG and Showsec had 
deliberately risked the safety of audiences in order to save money. 


It is implicit in the findings that | have made that both SMG and Showsec failed 
to take steps to improve security at the Arena that they should have taken. 

That does not mean that they deliberately risked the safety of event-goers. 
Further, not taking those steps did save the companies money but again that 
does not mean that they knowingly risked the safety of event-goers to increase 
their profits. 


It was inevitable that SMG and Showsec would look to save money when they 
could, both to increase profits and to ensure that they remained competitive. 
There are very few private and public organisations who do not do this. This did 
lead to reviews of staffing levels which management undoubtedly hoped 

would lead to savings. After those reviews, when warned by Miriam Stone that 
cutting staff would lead to a reduction in security, no reductions were made. 
While there is a sensible argument that not only were no reductions appropriate 
but that an increase should follow the change in terrorist threat, | do not think, 
looking at the evidence as a whole, that a finding that safety was deliberately 
compromised to save money Is justified, even on the balance of probability. 


The justified criticism on the evidence | heard is that SMG and Showsec did 

not take a number of necessary steps, some of which would have involved the 
spending of additional money, in order to provide a sufficient level of protection 
against the terrorist threat. 
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Key findings 


The health and safety regime imposed duties on both SMG and Showsec which 
were relevant to the safety of event-goers. 


The licencing process in Manchester did not consider the risk of a terrorist attack 
in deciding whether to grant a new licence or what conditions to attach. 


Police officers and staff who consider licensing applications did not consult with 
expert counter-terrorism police officers, such as CTSAs, before deciding whether 
to make representations to the local authority on whether to grant a licence and 
what conditions to attach. 


Manchester City Council's licensing enforcement regime failed to identify 
possible breaches of SMG's entertainment licence. One of those possible 
breaches may have contributed to the failure to prevent the Attack. 


The SIA's enforcement regime was insufficiently robust to identify a 
long-standing practice at the Arena in relation to Showsec’s use of unlicensed 
stewards to search bags. 


The Security Industry Authority's investigation into a potential breach of the 
licensing regime in relation to the use of unlicensed Showsec staff to monitor 
CCTV at the Arena did not identify that SMG was using staff to monitor CCTV 
who required a licence but did not hold one. 


Introduction 


3.1 


3.2 


In this Part, | will consider the three statutory regimes which were particularly 
relevant to the matters | am investigating. They are the health and safety regime, 
the licensing regime and the Security Industry Authority regime. Each are 
regulated by primary legislation. 


My review is not intended in any way to be exhaustive, it is confined to aspects 
of those regimes most obviously important to the events of 22"? May 2017. 
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3.3 


3.4 


3.5 


3.6 


3.7 


Central to the health and safety regime is the Health and Safety at Work etc. 
Act 1974 (the ‘1974 Act’). Underpinning and complementing it are a number of 
Statutory Instruments which identify further duties and address specific areas of 
activity in relation to which risk arises. 


Core duties for employers appear in sections 2 and 3 of the 1974 Act. 

Section 2 concerns the employer's duty to its employees. Section 3 concerns 
the employer's duty towards non-employees who may be affected by its 
undertaking. ‘Undertaking’ is the word used in the statute. Elsewhere in 

my Report | have used the word ‘activities’ to make the meaning clearer. 

Under s.33(1)(a), it is an offence to fail to discharge the duties in sections 2 

and 3. SMG and Showsec were both employers and so were under these duties, 
which were relevant to the safety of event-goers. 


By reason of s.33(1)(c) of the 1974 Act, it is an offence to contravene regulations 
within the Management of Health and Safety at Work Regulations 1999. 


Regulation 3 of the Management of Health and Safety at Work Regulations 
1999 requires an employer to conduct a suitable and sufficient assessment 

of the risks to health and safety both in relation to employees and in relation 
to non-employees arising out of, or in connection with, the conduct of its 
undertaking. Any employer who employs five or more people must record “the 
significant findings of the assessment’. | shall address the issue of SMG and 
Showsec's risk assessment in Part 6. 


Regulation 11 of the Management of Health and Safety at Work Regulations 
1999 makes provision for workplaces shared by more than one employer, as 
was the case with SMG and Showsec at the Victoria Exchange Complex. Where 
two or more employers share a workplace, each employer is required to: 
co-operate with other employers in relation to health and safety duties; 
coordinate with other employers in relation to health and safety duties; and 
inform other employers of the risk to their employees’ health and safety arising 
out of its activity. The requirement is to take all reasonable steps. The connected 
concepts of co-operation, coordination and communication as between SMG 
and Showsec will be addressed in greater detail in Part 6. 
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Part 3 Statutory context 


Licensing Act 2003 framework 


3.8 As set out in Part 2, SMG (UK) was the holder of a premises licence for the 
Arena granted by Manchester City Council on 9* September 2005, which 
contained a large number of conditions.**! Under the Licensing Act 2003 (the 
‘2003 Act’), once a licence is granted it remains in existence unless and until it 
is revoked following a review or it is surrendered.*°* Breaches of conditions are 
intended to be treated seriously. A breach is a criminal offence and can lead toa 
prosecution and a review of the licence.’ 


3.9 The power to grant and review a licence and impose conditions ona 
licence is vested in the licensing committee of the Council made up of 
elected representatives.*4 Under section 4 of the 2003 Act, a licensing authority 
must carry out its functions with a view to promoting the licensing objectives. 
These include public safety and the prevention of crime and disorder.*© 
Section 182 of the 2003 Act requires the Home Secretary to issue guidance to 
licensing authorities on the discharge of their functions under the Act. Section 
5 of the 2003 Act requires each licensing authority to determine and publish its 
policy with respect to the exercise of its licensing functions. 


3.10 Considering the risks of a terrorist attack and requiring steps to be taken to 
mitigate it come within the licensing objectives. Therefore they are capable 
of being, and arguably should be, part of the consideration whether to grant 
a premises licence and, if granted, what conditions to attach to ensure the 
terrorist risk is kept to a minimum.*& 


3.11 That did not arise in the case of the Arena as the licences were first granted a 
significant period of time ago, under different legislation which was in force 
before the introduction of the 2003 Act.’ Prior to the 2003 Act, control of 
liquor licences was given to the local Magistrates, while public entertainment 
licences were the responsibility of the local authority. There was an automatic 
right, when the new Act was introduced, to convert those licences to the new 
premises licences. The existing conditions were simply carried over.*© 


3.12 Asaresult of requests for information made by the Inquiry, it has become 
apparent that, until now, consideration of the risk of a terrorist attack and 
requiring steps to be taken to mitigate that risk has not been part of the 


16 


2 


INQ035447/1-2, INQ035447/3-5, INQ035447/4-6, INQ035447/8-10, INQ035447/14 
16/79/20-80/15 

16/100/19-22, 38/48/8-22 

16/57/20-58/20 

16/59/19-60/1 

38/14/11-15/17 

16/101/11-18 

16/84/6-86/6, 38/7/2-8/22 


16 


me 


16 


w 


16 


B 


16 


a 


16 


a 


16 


N 


16 


toa) 


49 


Manchester Arena Inquiry Volume 1: Security for the Arena 


investigations made by local authorities before deciding whether to grant a 
licence and what conditions to attach. This may be starting to change following 
the events of 22"7 May 2017, but it is something which would be difficult 

for local authorities to achieve on their own. Licensing authorities with the 
assistance of the police have always been concerned to try and ensure that an 
additional licence would not cause public nuisance or excessive drunkenness 
on the streets. Consideration has also been given to the risk of the sale of 

drugs on licensed premises but there has been little, if any, consideration of the 
attraction that large, popular licensed premises such as the Arena would present 
to a terrorist.’©° 


3.13 If there are no representations received by a local authority, then they must 
grant the licence.’”° While a local authority can make their own representations, 
they do not have the expertise to consider in detail counter-terrorism 
measures.’1 Representations can be made by the police but, to date, it does 
not seem that the police officers or staff who consider licensing applications 
consult with expert counter-terrorism police officers, such as Counter Terrorism 
Security Advisors, before deciding whether to make representations.’ This is 
surprising as licensed premises have long been recognised as an attractive 
target for terrorist attacks. 


Licensing enforcement 


3.14 When the new Licensing Act was put before Parliament, the intention was said 
to be that it would be light touch regulation so far as the granting of licences 
was concerned, but there would be strict enforcement for those who breached 
the conditions of their licence.’”* From the evidence | have heard about 
what happens in Manchester, | doubt that strict enforcement of breaches of 
conditions takes place In practice. 


3.15 Manchester is meant to have 42 licensing enforcement officers, but they are 
never up to strength and, at the time of the hearings, they were eight short. 
Of those 42, there should be 21 in a city centre team and 21 ina city-wide 
team.’ Even if they were to have a full contingent, this does not allow 
them sufficient resources to do unannounced checks. They have to rely on 
intelligence they receive and liaison with a police licensing team, which is also 
small, to try and ascertain if there are breaches of conditions and take action.’ 


3.16 The evidence given at the Inquiry was to the effect that the licensing process 
in Manchester did not consider the risk of a terrorist attack in deciding whether 
to grant a new licence or what conditions to attach. It was also not considered 
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as part of the compliance process. This is not surprising in light of the fact that 
government guidance published under section 182 of the 2003 Act is silent 
about the terrorist threat.’ 


3.17. That said, Manchester City Council in its own policy statement dated 
A January 2016, has two paragraphs entitled ‘Working to prevent the threat 
of terrorism’.’” They read as follows: 


"2.23 Terror attacks have previously been targeted at bars, pubs and 
nightclubs in the UK. All premises are expected to have regard to the 
NaCTSO publication ‘Counter Terrorism Protective Security Advice for 
Bars Pubs and Nightclubs’. 


2.24 Licensed premises in the city centre are expected to be prepared in 
accordance with the City Centre Emergency Evacuation Plan.” 


3.18 = The NaCTSO publication referred to is extremely useful; but those two 
paragraphs do not indicate that there will be a careful consideration of the 
terrorist threat by a licensing committee when carrying out its functions. 


3.19 While the Inquiry has not heard directly from other local authorities, the 
information we have received suggests that Manchester is not unusual in 
ignoring issues of terrorism when carrying out its licensing functions. As 
a response to the Attack, there are signs that this is changing, and some 
local authorities are considering whether and in what way they should take 
the terrorist threat into account.’ Manchester City Council has adopted 
a new policy and is intending to incorporate some of the requirements of 
Martyn’s Law into its new policy which will govern how it will make decisions 
in the future.’”? | will consider Martyn’s Law in greater detail when | set out 
my recommendations in Part 8. 


Monitoring of compliance with licensing conditions at the Arena 


3.20 There were conditions on the Arena licence which were designed to protect 
the safety of the public. The evidence suggested that a number of them may 
have been ignored. It is not my role to reach conclusions as to whether there 
were licence breaches unless relevant to the Inquiry’s terms of reference. | have 
identified two breaches below which are relevant, the second of which may 
have contributed to the failure to prevent the Attack. 
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3.21 


3.22 


3.23 


3.24 


First, it was accepted that the statutory condition that required stewards at the 
Arena carrying out searching to have SIA qualifications'®° had been ignored for 
many years, if it had ever been complied with.** This was an important measure 
brought in by the government because of concern about the way in which 
some door supervisors in the licensed trade carried out their work.1®2 


While the breach of that condition did not play any part in the events of 
22™ May 2017, it does indicate a failure by SMG to have adequate regard 
to an important condition on the licence. There was also an absence of 
any knowledge of this breach by the licensing enforcement team, despite 
the fact that it had gone on for many years. | will return to this issue of 
SIA licences shortly. 


Second, condition 86 of the premises licence provides that the minimum 
number of stewards as agreed by the local authority shall be provided to 
perform the functions and duties specified.*®* The purpose of this condition is 
to ensure there are sufficient stewards and security staff to manage the crowd 
and monitor the area for threats. | was concerned to be told that an agreed 
minimum number could not be found. There was no evidence that there had 
ever been an agreed number.**4 


The Security Experts were of the view that the number of security staff on 

22™4 May 2017 was “sub-optimal”. Had a minimum number been agreed 
between SMG and the local authority, it may have been higher and the staffing 
levels would have been closer to the optimum number and more effective in 
identifying SA as suspicious. 
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Background to the SIA and its functions 


3.25 The Security Industry Authority was set up by the Private Security Industry 
Act 2001 (the ‘2001 Act’) which came into force in 2003.18 There had been 
concerns at the way people employed in security carried out their duties in 
locations such as licensed premises. As a result of that legislation, security 
operatives were required to obtain a license before they could carry out certain 
security functions.*% 


3.26 Different licences are required depending on the function which the operative 
is employed to carry out. In order to obtain a licence, a fee has to be paid, the 
applicant has to be over 18 and has to pass a qualifying examination, a criminal 
records check must be completed and the applicant must have the right to 
work in the UK." The fee, at the time of the hearing, for a door supervisor 
licence was £190.18° The necessary qualifications are granted not by the SIA 
itself but by a number of government-approved awarding organisations who 
are subject to supervision by Ofqual. Training providers are approved by the 
awarding organisations and the awarding organisations are responsible for 
quality controlling providers.1?° Most of the training for the qualification is 
intended to be in person with a small part of it being online training." 


3.27. ~The Inquiry heard criticisms from two witnesses about the quality of the training 
they had received. In one case, none of the training was in person.’ In another, 
the candidates were told the answers to the exam questions by the training 
provider.’?> | was not in a position to investigate how justified those complaints 
were, but the SIA are now aware of them and | would expect them to investigate 
whether they are accurate. Making sure that the training is done properly and 
professionally is obviously important. The SIA should make sure that there are 
regular and unannounced checks carried out on training providers. | heard 
evidence that the awarding organisations do this already,’% but it would also 
be worthwhile for the SIA or Ofqual to consider carrying out spot checks with 
SIA-licensed individuals who have received the training to get a better idea of 
what actually happens. 
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3.28 The content of the training has changed since 2017 and now includes a greater 
proportion and better quality of counter-terrorism training.*?° The SIA has said 
that if a Protect Duty becomes law, and includes mandatory ‘Action Counters 
Terrorism’ (ACT) training, that it would include that as part of its course work.'%° 
| will consider the Protect Duty when | come to consider my recommendations. 
The SIA expects employers to carry on with in-house training after the initial 
qualification has been achieved. At the moment, whether employers provide 
follow-up training is voluntary.’?” Where it is provided, it is often online. Whether 
employees actually carry out online training depends on their willingness to do 
so. It is obviously important that checks are carried out to ensure that the online 
training is carried out and that information is absorbed and understood. 


Relevance of SIA licensing to 22"? May 2017 


3.29 The two areas of activity where an SIA licence was required which were relevant 
to this Inquiry are door supervisors and CCTV operators. There is little incentive 
for contractors to ensure that licences are obtained. To obtain a licence the 
applicant needs to be 18. The security business employs large numbers of 
people under that age who are cheaper to employ. Providing more SIA licensed 
door supervisors is an expense which may be passed onto the hirer. 


3.30 It was accepted in the hearing that Snhowsec used unlicensed staff to do 
bag checks. This Is activity which is part of a door supervisor role and requires 
a licence.'°8 Showsec knew such staff should be licensed. The issue was 
drawn to Showsec’s attention in 2013 by its head of training and confirmed by 
the SIA.1°° Despite this, the use of unlicensed staff to check bags was continuing 
at the date of the Attack.2°° 


3.31. This demonstrates the lack of effective enforcement measures to ensure 
that the requirements of the 2001 Act are carried out, despite the fact that 
breaches of the 2001 Act are criminal offences which carry maximum sentences 
of imprisonment. There are only 50 enforcement officers employed by the SIA 
covering the whole of the country and a single officer in Manchester, where 
there are approximately 18,000 SIA licence holders.*° While there is some 
proactive intervention from enforcement officers, in reality, the SIA have to rely 
on information from partners, such as police officers, along with complaints 
from the public, to inform them of potential breaches.2% 
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The other area requiring a licence the Inquiry heard evidence about was CCTV 
operators. An individual operating CCTV equipment requires a licence, if that 
person proactively monitors the activities of members of the public, whether 
they are in public areas or on private property. This is required if the individual 
is working for a contractor who is working under a contract for services. As set 
out in Part 2, | am satisfied that it was likely this was the status of at least one of 
SMG’'s employees who operated the CCTV on 224 May 2017.2 


In November 2015, a complaint was made to the SIA that the CCTV at the Arena 
was being operated by unlicensed operators. The complaint was in relation to 
Showsec operating the CCTV.?" As the evidence revealed, Showsec did provide 
employees to work in Whisky Control.2°° On occasions, those staff monitored 
the CCTV;2°° although whether this was before or after the complaint, | am not 
able to say. 


The complaint was dismissed on the basis that the CCTV operators were 
“in-house".?°” This conclusion was reached on the SIA’s understanding that the 
CCTV was operated only by SMG employees.?°8 


It would be of benefit to all CCTV operators to undertake the SIA licence 
training or something similar. The SIA CCTV operator's licence training includes 
content designed to assist identification of a person who may be carrying an 
Improvised Explosive Device (IED) by reference to the circumstances that should 
arouse suspicion, such as suspicious behaviour or clothing.?°° 


The evidence that | heard suggests that it was not just Showsec employees who 
required a licence to operate the CCTV. SMG employees were operating the 
CCTV pursuant to a contract to provide security for the building, the facilities 
management agreement. That is a contract for services, and it was mandatory 
for those employees to have licences. If that is correct, then it may be that the 
SIA got it wrong when they concluded that no offence had been committed. 

| do not know what the SIA were told by SMG when they investigated the 
matter and, in particular, whether they were told of the existence of the facilities 
management agreement. 


In any event, it does seem odd that there should be a distinction in the need for 
a licence depending on whether the operator is working under a contract for 
services or as a direct employee. The same skills are required and there would 
seem to be a good argument for saying that training Is required when operating 
a CCTV camera focused on a public space, whatever the employment status of 
the person doing it.**° | will deal with this further in my recommendations. 
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3.38 The SlA also runs an Approved Contractor Scheme (ACS) which operates on 
a voluntary basis and has around 800 members.*"* Showsec are an approved 
contractor?” and have played a prominent part in setting up the scheme. 
That makes it even more regrettable that, for a period of years, it has been 
allowing its unlicensed staff to carry out bag checks, even when Showsec knew 
they ought to have licences. The ACS appears to be principally self-certifying, 
but assessors do appraise the conduct of the contractors concerned. If the 
ACS is continued or expanded, it is important that the ACS brings with it a 
quality assurance on which the public can rely. 
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Key findings 


The voluntary nature of the CTSA system and the lack of any specific duty to 
identify and mitigate the risk of terrorism means that system is inadequate to 
provide a proper level of protection to the public. 


The CTSA did not consider and advise on what security was required to protect 
against an attack by a person-borne IED in the City Room, particularly during 
egress or ingress. There was nothing about that issue on the Protective Security 
Improvement Activity form to bring that particular area at those particular times 
into focus. 


The way the CTSA spoke to SMG about the Protective Security Improvement 
Activity scores could have led to a false level of reassurance being provided 
to SMG. 


BTP and GMP CTSAs should have co-operated and had regular communication 
in relation to their respective processes within the Victoria Exchange Complex. 
The CTSA culture at the time meant that organisations in Showsec's position 
were not invited to participate in the CTSA process. Security at the Arena would 
have benefitted from Showsec’s involvement in that process. 
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4.1 CTSAs are part of the government's policy for combatting terrorism which is 
overseen by the Office for Security and Counter Terrorism (OSCT).2 The policy 
is Known as CONTEST. There are four strands to CONTEST: Protect, Prepare, 
Pursue and Prevent.” CTSAs are concerned with the Protect and Prepare 
strands and are accredited by and work with the National Counter Terrorism 
Security Office (NaCTSO) which is part of Counter Terrorism Policing. NaCTSO 
inform and oversee the work of Protect and Prepare.” 


4.2 The relationship between OSCT, NaCTSO and other parts of the national 
framework for countering terrorism is set out below in Figure 10. 
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Figure 10: The relationship between OSCT, NaCTSO and other parts of the national 
framework for countering terrorism??® 
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Part 4 The Counter Terrorism Security Advisor system 


NaCTSO is concerned, amongst other things, with providing advice and 
guidance around protective security for “crowded places”.*'° 


In providing that advice and guidance, NaCTSO supplies videos, written 
documents and sets up exercises which are provided to the private sector and 
to the public by CTSAs.*° CTSAs also provide advice and guidance to some 
individual sites in relation to what steps can be taken to reduce their vulnerability 
and prepare for potential terrorist attacks.**t There were insufficient CTSAs to 
provide that advice to all crowded places on an individual basis.**? The process 
to qualify as a CTSA takes approximately two years.**° CTSAs are the most highly 
trained counter-terrorism advisors in the country.” | accept that those who 
dealt with the Arena were highly trained and highly skilled.22° 


The basis on which sites were selected to receive advice has altered 

over the years. From about 2008, sites were selected on the basis of 

their vulnerability. In 2014 that changed, and sites were selected on the basis of 
their attractiveness to terrorists.*76 


Under the new attractiveness scheme, there are three tiers. The Arena was 
graded Tier 2(b): the “2” indicates that the Arena, “whilst not of national or 
international prominence, nevertheless has a profile above local or have 

a significant attendance by notable users (albeit infrequent, irregular or 
unpredictable)";?” the “(b)" indicates that at the time of designation the Arena 
had “a more developed security stance."**° 
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4.7 In 2017 there was no statutory duty which referred specifically to the 
requirement to assess the risk of terrorism or put in place measures to mitigate 
that risk. That remains the case today, although the government is currently 
consulting on the introduction of a statutory Protect Duty. The network of 
CTSAs offer their advice to venue owners and operators. It is a voluntary 
system and there is no mechanism to compel engagement, nor to enforce the 
implementation of a CTSA’s recommendations. 


4.8 There is a large volume of guidance available through the Centre for the 
Protection of National Infrastructure (CPNI) and NaCTSO outlining the terrorism 
threat and possible mitigating measures which can be taken. | formed the clear 
view that the quality of this guidance was adequate in May 2017 and it has 
continued to be improved and updated since. There was some criticism that 
before May 2017 there was insufficient focus on grey spaces or the risk of attack 
at egress.**? Deputy Assistant Commissioner (DAC) Lucy D’Orsi of Counter 
Terrorism Policing accepted that the 2017 Attack marked a “watershed moment" 
which led to a greater emphasis on those issues. GMP’s Principal CTSA, 
Elizabeth Forster, agreed.?°° 


4.9 The unanimous view of all those who expressed a view to this Inquiry, was that 
the voluntary nature of the CTSA system and the lack of any specific legal duty 
to identify and mitigate the risk of terrorism has posed problems. | agree. 


4.10 Figen Murray told me of her efforts to campaign for a change in the law: 
to introduce freely available counter-terrorism training; a requirement 
for vulnerability assessments of venues and public spaces; and a duty to 
have a counter-terrorism action plan and to take measures to mitigate any 
risks identified.*** 


4.11 Shaun Hipgrave, Director of Protect and Prepare within OSCT, agreed that 
the difficulty with a voluntary scheme is that there is a range of take-up and 
enthusiasm from private concerns.*** He described the work that is currently 
being done by OSCT to change the legislative framework to impose a Protect 
Duty upon those who ought to be responsible for the safety of the public when 
they are in a publicly accessible location and to provide further information or 
training to help them fulfil that duty.?% 
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DAC D'Orsi said, “/ think there's always a gap in a system that’s discretionary. 
The way forward is new legislation and | have always been an advocate of a 
[Protect] duty."?*4 


The Security Experts thought the voluntary nature of the CTSA scheme was 
inadequate to address the threat of terrorism. They support the introduction of a 
mandatory Protect Duty. They commented that some form of inspection and 
enforcement regime would be necessary to make the duty effective and that the 
number of CTSAs would need to be increased or others with suitable expertise 
who are accredited by reputable organisations used to advise venues.?*° 


So far as SMG is concerned, it is clear that SMG did understand its responsibility 
for security in the City Room and did engage with their CTSA. It follows that 
the fact that the system was voluntary made no difference to what happened 
on 22" May 2017. Nevertheless, the Attack at the Arena has given rise to a 
constructive debate about how the legislative framework can be improved. 

| make recommendations as to what the key elements of a Protect Duty should 
be in Part 8. 


Before | address the particular issues around the CTSA system as it operated at 
the Arena, | make clear that it is my view that a voluntary system Is inadequate to 
provide a proper level of protection to the public. 
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4.16 The Arena had been given advice by CTSAs, employed by GMP, for a number 
of years before the bombing. At the time of the bombing, the CTSA advising 
SMG in relation to the Arena was Ken Upham. | consider below whether specific 
advice should have been provided to the Arena by Ken Upham as to the risks 
to customers of an attack at egress into the City Room from the Arena. | also 
consider the related issue of the extent to which SMG was entitled to rely on 
any assurances provided by Ken Upham as to the level of protection already in 
place at the Arena. 


4.17. Ken Upham was employed by GMP as a civilian CTSA. There are about 200 
CTSAs working for regional police forces across the country. BTP employ a 
small number in addition.?°” 


4.18 The contact between Ken Upham and SMG began in 2014.7 It centred 
around a tool prepared by NaCTSO and used by CTSAs called the Protective 
Security Improvement Activity (PSIA).*2° This was an Excel document which 
was completed by the site and the CTSA.**° It takes a site through six common 
attack methodologies which included both vehicle-borne IEDs and a PBIED 
and awarded a score depending on protective security measures which were in 
place to protect the site against these attack methodologies.*4 


4.19 Depending on the answers, points would be awarded which would be totalled 
to provide an overall score.*4? Relying on the scores, an ‘Action Plan’ would 
be devised which would provide the site with ways in which it could improve 
its scores.*48 The CTSA visited on a quarterly basis.244 The PSIA would be 
completed every six months. 


4.20 There are anumber of issues with this system. First and foremost, as | have 
already said, it is entirely voluntary.**° The services of a CTSA are offered to 
a site but it is up to the site whether they engage with the CTSAs and, if they 
choose not to, there is no express obligation on them to get similar advice 
elsewhere.” For those who do engage, there is no express obligation on them 
to carry out the recommendations suggested in the Action Plan.**” One of the 
difficulties for CTSAs early on was that they were suggesting improvements 
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which have been described as ‘gold standard’ which had a very low take up.48 
As a result, in 2014 it became policy to advise clients that if they did not want to 
adopt the gold standard solution then they should do something which was less 
expensive on the basis that “something was better than nothing".**? DAC D'Orsi 
explained that the reason for this was a change in the nature of terrorist attacks 
which she said had become less sophisticated so that relatively straightforward 
and cheap measures could be adopted which would improve security.*°° It may 
be that with the benefit of hindsight “something was better than nothing" was 
an unfortunate choice of phrase.*** Whatever one’s view of this, it had nothing 
to do with the events at the Arena on 229 May 2017. 


SMG did engage with the CTSA scheme and did make improvements in 
accordance with the Action Plan. It was unfortunate that SMG was not provided 
with a copy of any of the PSIAs or the Action Plans, except the first ones.7°2 
SMG should have been supplied with copies of all of them.*°> What was also 
required was a clear understanding by SMG that the CTSA was not providing 

an audit of security.” It was not a CTSA’s role to tell a venue that they 

had complied with their responsibilities and that their security procedures 

were satisfactory. 


Although Ken Upham did not give evidence because of ill health, the Inquiry 
received three statements from him.%°° | have had firmly in mind that | have not 
heard from Ken Upham from the witness box, but | have no alternative but to 
resolve any relevant factual dispute on the basis of the evidence before me. 
While | have taken fully into account his statements, there is always a risk that 
evidence given in person will have more impact. | have borne this in mind and 
have done my best to make allowance for it. 


Ken Upham made clear in those statements that he did not consider that 

it was part of his role to consider the security in the City Room as a whole. 

He concentrated his attention on the entry through the doors from the City 
Room into the Arena bowl itself. He also categorically denied having advised the 
Arena that it was doing all that it could or that he was happy with the security 
procedures in place at the Arena on both event days and non-event days.”°° 

| accept Miriam Stone's evidence that Ken Upham did indicate to her that the 
PSIA figures were good and SMG should continue with what they were doing.?°” 
This was not an appropriate view to express. It could have given Miriam Stone 

a false level of reassurance. However, even in these circumstances, there were 
clear limits to any reassurance, as | shall go on to explain. 
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4.24 Ken Upham was reliant on the information provided to him being correct.?°8 
He did not check it. It was not his job to do so**? nor did SMG have any reason 
to think he had done so. So, for example, if he had asked whether the CCTV 
provided good coverage, which he might have done, he would very likely have 
been told by Miriam Stone that it did, as she was not aware of the Blind Spot.?©° 
Further, his focus was on the Arena rather than the areas outside, such as the 
City Room.?* 


4.25 While an overall score might have been high, it did not mean that there were 
no significant improvements required in certain areas. In the case of CCTV, it 
was given a score of “3” out of 37°? which suggests that all that could be done, 
had been done. Given the failings | have identified in SMG's approach to CCTV 
monitoring in Part 6, any indication that SMG’s CCTV system had no room for 
improvement was misplaced, inappropriate and risked essential remedial steps 
being overlooked, as in fact they were. 


4.26 Some of the information on the PSIA form was incorrect, for example in relation 
to searching.7&° Ken Upham accepted this.2°* The form was completed on the 
basis that there was more searching than there was.*° The most significant gap 
in the advice given by Ken Upham, which is relevant to the Attack, is that Ken 
Upham did not concern himself with advising what security measures were 
required to protect against an attack by a PBIED in the City Room, particularly 
during egress or ingress. This was when customers coming to or leaving an 
event would be there in considerable numbers, making it an attractive crowded 
space for an attack.*°° There was nothing about that on the PSIA form to bring 
that particular area at those particular times into focus.?°” 


4.27. Ken Upham considered the security measures in the City Room only in so far as 
you could enter the Arena from there.*°8 He considered what protections were 
in place at the entrance to prevent a PBIED being taken into the Arena itself.2° 
He did not consider what, if anything, could be done to prevent a PBIED being 
exploded in the City Room. Elizabeth Forster, Ken Upham’s line manager, 
confirmed that the CTSA was concerned with safety in the Arena itself.?”° 
As such, Ken Upham’s approach was consistent with what his line manager 
expected him to do. CTSAs considered protections outside the Arena, such as 
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against a vehicle-borne IED, from the perspective of preventing such threats 
getting into the Arena. The focus was on the safety of the public inside the 
Arena itself, not on what might happen to them outside. 


4.28 DAC D’Orsi says that it should have been obvious to everyone that the City 
Room could be a target for attack at times when it was crowded.’”! It is 
therefore unfortunate that Ken Upham did not regard it as part of his brief to 
consider it. However, Miriam Stone Knew that the PSIA scoring system was 
primarily aimed at protecting the public inside the Arena.2” 


4.29 While the NaCTSO advice was adequate, it did not contain specific written 
advice dealing with risks at times of egress from events.?”3 The NaCTSO Project 
Argus training, launched in Spring 2016, included a scenario dealing with the 
effects of an attack as people are leaving an event.?” It was concerned with a 
how to deal with an attack if it happened rather than precautions to prevent an 
attack taking place. DAC D’Orsi took the view that it would be inappropriate to 
deal specifically in written advice with risks at times of egress as that might lead 
to less weight being attached to risks at other times.*”° While that may generally 
be true, it makes it more important for CTSAs to consider particularly vulnerable 
points for each venue. Given the measures which existed to prevent a person 
gaining access to the Arena itself, the most vulnerable time for the Arena was 
on egress. At this time there would be the largest numbers of people in the 
City Room. 


4.30 Thesecurity of the City Room, because of its complexity, may have been 
beyond the expertise or experience of some CTSAs.*”° Ken Upham could have 
advised SMG to obtain assistance from external security experts. There was 
nothing to prevent him doing so, except for the practice of CTSAs not to do it.?”” 
Where this situation arises in the future, it would seem sensible for a CTSA to 
give advice that external security experts should be retained. | shall consider 
this further when | deal with recommendations associated with a Protect Duty 
in Part 8. 


4.31 —_|t would also have been of assistance if Ken Upham had monitored an event, 
to see how the security operation worked in practice. This would have enabled 
him to check the accuracy of the information contained on the PSIA form.?”8 
He would then have appreciated, for example, that the information relating to 
what searches were carried out on the form was inaccurate. 
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4.32  |f he had attended an event, he might have become aware of the shortcomings 
in the CCTV coverage and the failure to carry out proper patrols. It was not the 
practice of CTSAs to attend events at the time?”? and | make no criticism of Ken 
Upham for not having done so. There was a lack of capacity within the CTSA 
system for such visits to form part of their duties.2°° 


279 41/158/8-17, 41/160/6-15 
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4.33 


4.34 


4.35 


There should have been co-operation between a BTP CTSA considering the 
security in the station, with the GMP CTSA considering security at the Arena.?*! 
The contrary was not suggested by anyone who gave evidence. There seems to 
be no reason why that did not happen, although the evidence | heard did not 
reveal who, if anyone, was at fault in this regard. As the two locations are part of 
the same complex, it would clearly make sense to consider the overall security 
at the Victoria Exchange Complex rather than making individual assessments of 
the station and the Arena. 


Showsec's employees were not invited to meetings with the CTSA. Elizabeth 
Forster saw no reason why, in principle, a third-party contractor involved 

in the security arrangements, such as Showsec, could not be involved in 

the meetings.*** The evidence suggests that it was not the culture at the time 
for CTSAs actively to encourage sites to invite others to attend their meetings.?® 
In appropriate circumstances, | can see no reason why a contractor in 
Showsec’s position would not be invited to participate either by the CTSA or the 
venue operator. 


There are obvious advantages in involving Showsec in this process. 

Important information about, for example, searching, would have been relayed 
first-hand. Involvement of Showsec would have brought more benefits than 
just ensuring accurate information. It would have embedded Showsec into a 
process focused on counter-terrorism. It would have caused Showsec to think 
more about counter-terrorism. It would have led to more discussion about 
counter-terrorism between SMG and Showsec. It is important that the CTSA 
process involves representatives of every organisation which holds a security 
responsibility for that site. The greater the communication, the better the 
coordination will be. 
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Key findings 


5.1 


5.2 


SMG needed input from an expert in security beyond that provided by the CTSA, 
BTP and/or Showsec. That expert should have been retained to undertake a 
comprehensive review of and provide advice on the entirety of the security 
arrangements at the Arena. This was obvious, or should have been. SMG should 
have obtained this expert security input prior to 22"7 May 2017. 


Had SMG done so, it is highly likely that the security arrangements at the Arena 
would have been improved. 


Such input would probably have resulted in changes that could have prevented 
or mitigated the Attack. 


Those changes may have included extending the security perimeter to prevent a 
terrorist gaining access to the City Room. 


SMG was responsible for the safety of those who attended events and others in 
the City Room. The Security Experts expressed the view that SMG should have 
had an in-house specialist senior security professional in 2017.78 


It was argued on SMQC’s behalf that it was entitled to rely upon the CTSA, BTP 
and Showsec for advice about counter-terrorism. Industry practice at the time 
was also cited as a justification for why SMG did not obtain input from beyond 
those three sources.’°° | will address each of these claims as against the Security 
Experts’ opinion above. This will involve consideration of both what security 
advice and support was being provided to SMG and what security was actually 
needed at the Arena. 


284 A1/195/9-16 
785 INQO39255/6-7 at paragraphs 15 to 20 
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5.3 Dr BaMaung stated that in 2017 “there were probably quite a few arenas 
that didn’t have that in-house expertise."*°° This was consistent with 
other evidence.?®” SMG relied upon what was said to be industry practice as part 
of the justification for not retaining a suitably qualified person or organisation 
comprehensively to review and advise on the entirety of the security measures 
at the Arena. 


5.4 This is not an adequate justification for SMG failing to obtain such advice 
prior to the Attack. SMG is a world leader in event management.?® It was, 
and is, a very substantial organisation.*°? The Arena was one of the largest 
venues in Europe.2?° Over one million people attended events there every 
year.**' The unique configuration of the Victoria Exchange Complex and the 
complications that created meant that relying on standard industry practice is 
not an answer. Expert counter-terrorism input tailored to the demands of the 
Arena, including the City Room, was necessary. This required a comprehensive 
assessment of all aspects of SMG’s operation by a person or organisation 
qualified to do so. 


55 Whether or not it was a common practice generally in 2017,°* shortly after 
the Attack and without apparent delay or real difficulty, SMG was able to 
obtain the services of expert security consultants.?9? Within three weeks 
of the Attack, representatives of SMG and Showsec met with SMG's 
new advisors.*% Within four months of the Attack, the Arena was able to 
reopen operating under a plan which had been designed in consultation 
with those independent experts.??° Additionally, SMG has retained a security 
director?* to provide it with security expertise, which it could have done prior 
to 22" May 2017. 
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5.6 The evidence of the SMG witnesses was that they relied upon the expertise 
and advice of Ken Upham. This included the fact that he did not suggest his 
expertise was limited or that they should seek additional assistance elsewhere.?°” 
Mark Harding, Showsec’s managing director, commented that in his experience 
counter-terrorism expert advice would be expected to come from CTSAs.??° 


on, As | have set out in Part 4, while Miriam Stone was entitled to take some comfort 
from the reassurance given to her by Ken Upham, security at the Arena and 
in the City Room remained the responsibility of SMG which was aware of the 
threat which it presented.?°? SMG had been told by Ken Upham that it must take 
responsibility for procedures and decisions.3°° 


5.8 Superintendent Edward Wylie was the commander for BTP’s Pennine 
Sub Division. Superintendent Wylie was involved with policing particular events 
at the Arena, such as boxing.*™ It was not appropriate for SMG to rely on its 
staffs’ interactions with him, as was suggested. His involvement was based 
on policing the Victoria Exchange Complex. He did not conduct an audit or 
comprehensive counter-terrorism assessment of SMG security systems.°° 


5.9 The fact that positive comments were made about training, searching and 
staffing*°* was capable of providing some reassurance to SMG. It was not an 
adequate substitute for a comprehensive review of the entirety of the security 
operation at the Arena by an appropriately qualified expert who had been 
retained for that purpose. 
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5.10 ‘It was denied on Showsec's behalf that Showsec was an expert in 
counter-terrorism.°°* Dr BaMaung accepted that they did not market themselves 
as having significant expertise.%°° Miriam Stone said that she thought Showsec 
had “expertise in counter-terrorism".*°° She cited a presentation given by 
Showsec in April 2016 as one part of the basis for this belief. | will deal with this 
presentation below. Miriam Stone stated that she expected Showsec to have 
told her if “they had seen something they thought was amiss" .3°” 


5.11. = Mark Harding agreed that Showsec was providing SMG with counter-terrorism 
input, in the sense that Showsec “provide some of those counter-terrorism 
services within the training of our staff. So an SIA licence-holder may well be 
asked to conduct counter-terrorism activities and we would help SMG with that 
process. So | think they were reliant on us to provide some of those services."°° 


5.12 There are a number of pieces of evidence which reveal that Showsec did 
consider it had some expertise in counter-terrorism and, implicitly or explicitly, 
held itself out as having such expertise. 


5.13 First, the Showsec training included a counter-terrorism module, the content 
of which | will deal with in greater detail in Part 6. This module was created by 
Showsec. Miriam Stone stated: “/ assume that you have to be an expert in it to 
write a training course for your staff on it."%°° 


5.14 Second, three days after the Bataclan theatre attack, and in direct response to it, 
Showsec director Mark Logan sent an email to other senior Showsec staff.*"° 
The opening paragraphs include: 


“The company aims to deliver best practice through third party engagement 
on a local and national level and we seek to use the guidance being offered 
by the security services which | have copied into the narrative of the email. 
These practices should be embedded into operating plans, risk assessments, 
counter terrorism advice, briefing, training (please see the e-learning module 
for refreshment) and standard operating procedures. “34 


5.15 Mark Logan stated of this passage that the word “advice” may have been 
“misplaced” and that the word “awareness” may have been more appropriate in 
its place.*!2 
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Also included within that email was a request that a review was conducted of 
“operating procedures” in light of the attack. The review Mark Logan envisaged, 
among other things, “Examinling] the control procedures, search templates, 
search queuing times, moving a queue to a place of safety, external operating 
environment, terms and conditions of entry."% 


Although this email was internal to Showsec, in my view it reveals Showsec’s 
view of itself and the extent of its own competence. This, in turn, will have 
informed the way in which Showsec presented itself to its customers and the 
way in which it spoke about its own capabilities as an organisation. 


Mark Logan's email was a responsible reaction to the Bataclan theatre attack. 
Implicit within it is that Showsec regarded itself as having the necessary 
in-house knowledge and experience to conduct the work he wanted to 

be carried out. Mark Logan went on to state his belief that his instruction 
was the “genesis"** of the document “Counter Terrorism Awareness 2017: 
Manchester Arena" (the Counter Terrorism Awareness 2017 document). 


| will deal in further detail in Part 6 with the content of “Counter Terrorism 
Awareness 2017: Manchester Arena’. It is sufficient to say here that implicit in 
the creation of this document was that Showsec regarded itself as competent 
to produce such a document. It involved both judgment about what available 
open-source material should be included in it, as well as how that information 
should be tailored for the specific circumstances of the Arena. This document is 
the third piece of evidence which has informed my conclusions on this point. 


Fourth, in April 2016 Mark Logan and his fellow director, Simon Battersby, 

gave a presentation to the National Arenas Association (NAA) and the 

European Arenas Association (EAA). This presentation was attended by 40 

to 50 people, including Miriam Stone and James Allen.*“© The presentation 

was entitled “The Role of Event Security in a CT Environment" (the NAA and 

EAA presentation).*’” Showsec was the only organisation to give a presentation 
on this topic. Included within the content of the presentation was a summary of 
attack methodologies together with advice of general application such as the 
importance of creating a “coordinated approach". 


“External and internal patrols" appear in a list under the heading 

‘Security Operation’.*#® Mark Logan stated of this list that the items in it were 
offered as “component parts or parts of our service”.*!? | will return to the issue 
of patrolling in Part 6. 
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5.22 The fact that Snowsec was prepared to give this presentation at this event 
indicates that Showsec regarded itself as having the necessary knowledge and 
experience to do so. 


5.23 Fifth, although Thomas Bailey stated that Snhowsec did not provide 
counter-terrorism expertise to the Arena, when asked whether he had ever 
been asked to give SMG counter-terrorism advice, he stated “Not beyond the 
limitations of what we could give."**° In the context of the other evidence, 
| regard this as further confirmation of the way in which Showsec was 
presenting itself to the outside world, which included speaking knowledgeably 
about its own counter-terrorism role. 


5.24 All of the above has led me to conclude that Showsec held itself out as having 
expertise in counter-terrorism within the context of crowd management and 
security. Showsec did not market itself as providing counter-terrorism advice 
to SMG so far as the conduct of SMG's operation was concerned, nor did 
the contractual agreement expressly provide for such advice. As such, while 
Miriam Stone was entitled to expect Showsec to point out issues related to 
counter-terrorism as they might have directly arisen from the way in which 
Showsec was conducting its own operation, she was not entitled to regard 
Showsec as playing a similar role to the one played by the company SMG 
contracted with after the Attack. | did not understand Miriam Stone to be 
suggesting that she had relied upon Showsec to that extent. 


5.25 | found the apparent dispute between SMG and Showsec about the extent 
of Showsec’s counter-terrorism role to be more imagined than real. It was 
substantially a product of a differing view about the meaning of the phrase 
“counter-terrorism expert’. The evidence established that both SMG and 
Showsec thought Showsec was competent to provide security services which 
included a counter-terrorism element. Neither SMG nor Showsec thought 
that Showsec had been retained to give detailed advice about SMG's overall 
counter-terrorism strategy. 


5.26 Accordingly, while Miriam Stone was entitled to rely upon Showsec to the extent 
she did, Showsec did not fill SMG’s substantial Knowledge gap in relation to the 
effectiveness of its overall counter-terrorism strategy. For this, SMG needed 
specialist Input from an appropriately qualified expert. 
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D:27 


5.28 


5.29 


5.30 


5.31 


It is highly likely that the security arrangements at the Arena in 2017 would 
have been improved if SMG had instructed an expert in security to conduct a 
comprehensive review of all the security measures that were in place. Such a 
review should have involved considering how events were run in practice. 

It should have included interviewing key security personnel, including 
employees from Showsec. The scope and operation of the CCTV also 
needed to be assessed as part of what was taken into account. Following this 
comprehensive review, the expert could have provided advice as to how SMG 
could improve its security arrangements. 


SMG should have obtained such input before May 2017. It could have been 
obtained from an external source or from someone employed by SMG for 
this purpose. 


It is likely that the security expert who considered the difficulties presented by 
the City Room would have advised that the security perimeter needed moving 
away from the Arena. That is what occurred when SMG instructed experts 
following the Attack.**4 


While better CCTV and regular and thorough patrols might have prevented, or 
reduced, the impact of an explosion in the City Room, preventing a terrorist 
from gaining access to that space was the better option. The only way to 
provide assurance against an explosion taking place in the City Room before, 
during or after an event was to extend the security perimeter and carry out 
searching before entry into the City Room. 


| will address the security perimeter, CCTV and patrolling in more detail in Part 6. 
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6.1 


6.2 


There are many steps that an organisation can take to reduce the risk of a 
terrorist attack or to reduce the impact of any attack that does take place. 
The measures considered below are not intended to be an exhaustive 
list. They are the measures focused upon by the Inquiry because of the 
circumstances and arrangements at and around the Arena in May 2017. 


These measures are: risk assessment, training, hostile reconnaissance response, 
security perimeter, CCTV monitoring and security patrols. | shall address each of 
them in turn as they relate to SMG and Showsec’s activity in May 2017. 
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Key findings 
SMG 


e At the time of the Attack, SMG had in place a general written risk assessment 
covering its activities. It was inadequate: it failed to adopt a rigorous approach 
to the assessment of the risk of a terrorist attack and did not identify what steps 
should be taken to reduce that risk. In any event, it did not form part of SMG’s 
planning or procedures at the time of the Ariana Grande concert. 


e SMG prepared a specific risk assessment for the Ariana Grande concert. It was 
inadequate: it did not identify the threat from terrorism as a potential hazard and 
had descended into a box ticking exercise. 


e SMQ's approach to risk assessment as it related to terrorism was inadequate. 
Had SMG put in place an effective risk assessment process at the Arena it would 
have identified deficiencies in the security arrangements including: the approach 
to CCTV; moving the security perimeter; the importance of patrolling in the 
City Room during events by Showsec; and, the breakdown in communication 
between SMG and Showsec in relation to the pre-egress check. 


Showsec 


e Showsec had in place a general written risk assessment in relation to the threat 
from terrorism to its employees. It was not an adequate document. 


e Showsec staff failed to notice the obvious and significant errors in the general 
written risk assessment in relation to the threat from terrorism to its employees. 


e Showsec did not have a general written risk assessment in relation to the threat 
from terrorism in relation to event-goers or other members of the public who 
might be affected by Showsec’s role in providing crowd management and 
security services. That was a substantial and serious omission on Showsec's part. 


e Showsec did consider the risk of a terrorist attack and what steps it should take 
to mitigate it in the document entitled “Counter-terrorism Awareness 2017; 
Manchester Arena". This document failed to identify the use of patrols as a 
mitigation measure against PBIEDs in the City Room. It should have done. 


e Showsec did not conduct a risk assessment which considered the threat from 
terrorism specific to the Ariana Grande concert. Showsec should have done. 


SMG and Showsec 


e SMG and Showsec should each have taken into account the steps being 
taken by the other when conducting risk assessments. The necessary level of 
communication, coordination and co-operation was not achieved 


e SMG and Showsec needed to know what BTP was or was not going to do at 
each and every event by way of deployment. That did not occur. 
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Risk assessment: threat from terrorism 


6.3 


6.4 


6.5 


6.6 


6.7 


6.8 


As set out in Part 3, both SMG and Showsec were under a legal obligation to 
conduct suitable and sufficient risk assessments in relation to their employees. 
They were also under a legal obligation to conduct suitable and sufficient 

risk assessments in relation to those who might be affected by their activities: 
in SMG's case, its activity as the Arena operator; in Showsec’s case, as the 
provider of crowd management and security services at an event. A number of 
documents were provided to the Inquiry relevant to these obligations. | shall 
consider each of them and the evidence | have heard about them. 


Before doing so, the importance of an effective risk assessment process needs 
to be underlined. Such a process has three important stages to it. The first is to 
identify and assess the hazards to the groups of people to whom a responsibility 
is owed. The second is to determine how likely it is that someone could be 
harmed and how seriously. The third is to take action to eliminate the hazard, 

or if this is not possible, control the risk. These are commonly known as 

control measures. 


It is necessary to say something more about the two parts of the second stage 
in relation to the threat from terrorism: likelinood and severity. Given the 
purpose of a terrorist attack will invariably be to cause maximum harm, the 
severity of the risk for it will always be of the highest order. There will be few 
risks which will have the potential to cause as much harm as those from a 
terrorist attack. 


When it comes to likelinood and the weighting given to it, it is important that 
considerable care Is taken. Fortunately, terrorist attacks are relatively infrequent. 
However, any successful attack will have catastrophic results. The events of 
22 May 2017 demonstrate so devastatingly that they must be prevented. 
Because the Statistical probability of a terrorist attack in any one place at any 
time may be very low, there is a risk of a mindset developing that “it wont 
happen here". Such an approach is wrong, particularly in the context of a risk 
assessment process. It is obviously so, when even a little thought is given to the 
potential consequences of this approach. 


The emphasis at the second stage should be on severity. The possible 
consequences of a terrorist attack are catastrophic. For this reason, they have to 
be given far more weight in a risk assessment than the likelinood of an attack on 
a particular site at any particular moment in time. 


In 2017, there were three other factors which were highly relevant to the risk 
assessment process and which should have been factored into it by both SMG 
and Showsec. 
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6.9 First, SMG knew that the Arena had been identified by counter-terrorism police 
as a Tier 2 site following the NaCTSO assessment in 2014.°*? The very placing 
of the Arena into this category should have made clear to SMG that it was an 
attractive target to terrorists. In Snhowsec’s case, while its employees were not 
invited to the meeting with the CTSA, its own risk assessment acknowledged 
SMG's engagement with Ken Upham. That risk assessment should have taken 
proper account of the CTSA process. 


6.10 Second, the national level for the threat from international terrorism, set by the 
Joint Terrorism Analysis Centre (JTAC), was “Severe”. This meant that “an attack 
is highly likely.” Proper account should have been taken of this fact. The risk 
assessment process should have accommodated the national threat level. 

It might have done this by setting out different levels of response based on 
the different threat levels. Alternatively and preferably, the assessment process 
should have required a complete review of the control measures when the 
threat level changed. This would increase the possibility that proper regard 
would be given to any new information which had emerged that justified the 
national threat level change. 


6.11 = Third, regular reviews of the risk assessment were essential.**5 In May 2017, the 
national threat level had been at Severe since 29" August 2014.5*4 However, since 
that time, the nature of the threat had been evolving. The terrorist attacks 
in 2015, in particular, gave notice of the very real threat of a PBIED. The risk 
assessment process should have recognised expressly the need for a constant 
refreshing of the thinking behind its content. This should have involved a regular, 
scheduled review of all of the content and material underpinning it. It should also 
have allowed for an unscheduled review if events warranted it. 


6.12 The above represents the minimum that a terrorism risk assessment should 
have included. | turn now to consider what the documentation submitted to the 
Inquiry, in fact, revealed. 


SMG 


Operational Procedures; Emergency and Contingency Plans document 


6.13. At the time of the Attack, SMG's general written risk assessments were 
contained within a document entitled “Operational Procedures; Emergency 
and Contingency Plans" (the Operational Procedures document).°*° Although 
the copy the Inquiry received is marked as revised on 25" May 2017,%° it 
was confirmed by SMG this was the date the document was printed.°?” 

This document had not been superseded or withdrawn prior to the Attack.%78 
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6.14 Within the Operational Procedures document are a number of risk assessments 
which are relevant to the threat from terrorism. The evidence did not reveal 
who the author of the risk assessments was, although they were added into 
the document by James Allen.*?° James Allen, Miriam Stone and a number of 
other senior people within SMG are indicated as being on the circulation list for 
the document. Also on the circulation list were GMP, BTP and Showsec.*3° 


6.15 At the start of the document the scoring of the assessments is described as 
“using a standard severity x likelihood table”. The ranges for the total are listed: 
a total score of 0 to 5 is said to be an “acceptable risk"; a total score of 5 to 10 is 
said to be “low risk”; a total score of 10 to 15 is said to be “medium risk"; and, a 
total score of 16+ is said to be “high risk”. The document states that “Emergency 
contingency plans have been enclosed for situations that have scored a rating 
of five or above as incidents below this score will offer negligible risk." *** 
The document does not explain how exactly a user is expected to apply the 
total score in any practical way. 


6.16 Within the subsequent risk assessments are three which | regard as most 
relevant to events on 22™ May 2017: “Bomb Detonation’;** “Explosions’;** and, 
“First Aid Injuries: Multiple and Major Injuries caused by Explosions" .3*4 


6.17 _— The first of these falls in a list of hazards under the heading “Acts of Terrorism 
within the Venue"; the second falls in a list of hazards under the heading 
“Incidents outside the Venue”; and the third under “Medical Incidents". Each of 
these have been completed against five different “profiles”: three types of event 
ranging from “low risk" to “high risk", “load in / load out" and “Non event mode". 
Each of the profiles has three columns completed with a number: “severity”, 
likelinood" and “total”. 


6.18 The “Bomb Detonation" risk assessment appears in Figure 11. It provided total 
scores which ranged between "5" and "15", depending on whether the event 
profile was said to be “low risk", “medium risk" or “high risk". The event profile 
risk was determined by the national threat level and how “contentious” the 
artist or event was. Miriam Stone stated that, given the national threat level, all 
events at the Arena at the time of the Attack were high risk.*° Within the terms 
of the document's approach to scoring, a total score of "5" was at the top of the 
“acceptable risk" and the bottom of the “low risk" category. A total score of "15" 
was at the top of the “medium risk” category.**© 


528 29/29/10-11, 90/91/22-92/5 
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ACTS OF TERRORISM WITHIN VENUE 


RISK DEFINITION AFFECTING SEVERITY/LIKELIHOOD 
LOW Low national/regional threat level (as advised by GMP/BTP) 


Non contentious artist/event content 
Limited press/media interest 
MEDIUM Medium threat level 
Major press/media interest in event/artist 
HIGH _ High threat level 


Contentious artist/event 


Hazard Profile Severity Likelihood Total 


Bomb Causing multiple deaths Event - low risk 5 1 5 
peoneten Event - med risk 10 
Event - high risk 15 


Load in / Load out 


alalala 
alsalowlnrn 


Non event mode 


Figure 11: SMG ‘s “Bomb Detonation" risk assessment?” 


6.19 The most relevant risk assessment by reference to what occurred on 
22™ May 2017 was “Explosions”. This appears at Figure 12. Whether an event 
profile was “low”, “medium” or “high" was determined, according to the 
document, by the effect on the venue. The person who completed the form 
assessed the severity for all of the profiles in the “Explosions” scenario as being 
"5" out of a possible 5; with the likelinood for all of the profiles as being “2” out 
of a possible 5. This produced a total score for each of the profiles, regardless 
of whether the event profile was low, medium or high risk, of “10”. According to 
the explanation of the scoring, this total score equates to the top of the 
“low risk" category or the bottom of the “medium risk" category. 


INCIDENTS OUTSIDE THE VENUE 
RISK DEFINITION AFFECTING 
SEVERITY/LIKELIHOOD 
LOW _ Nothing happening to affect the venue 
MEDIUM Asingle incident which affects the venue 


HIGH More than one incident affecting the venue 


Hazard Risk Severity Likelihood 


Incidents outside the venue — continued 


Explosions Detonation of improvised explosive device Event - low risk 


Event - med risk 


Event - high risk 


Load in / Load out 


altar al ala 
NP MITNM] NMI NM 


Non event mode 10 


Figure 12: SMG’s “Explosions" risk assessment*® 
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Also relevant was the risk assessment for “First Aid Injuries: Multiple and Major 
Injuries caused by Explosions" .**° This appears in Figure 13. This risk assessment 
took the same approach to the scoring for events as “Explosions”, giving a total 
of "10" for all event risk profiles. For this risk assessment, whether or not an 
event profile was “low", “medium” or “high" risk was determined by the number 
of attendees, whether those attendees were likely to cause trouble and whether 


there was any “historical data”. 


MEDICAL INCIDENTS 


RISK DEFINITION AFFECTING SEVERITY/LIKELIHOOD 


LOW Attendance of 5,000 or less. Seated floor. 
Family or mature adult audience profile 


Good historical data with less than 1% accident rate 


MEDIUM Attendance of 5,000 - 10,000 


Hazard 


Standing floor with limited movement 
Young adults in mixed sex groups 
Good data with 1 - 2% accident rate 
Attendance of 10,000 or above 


Standing floor with extensive crowd movement 


Teen, over 50+ years or rival fraction audience 


No historical data 


Profile Severity 
Caused by Explosions Event - low risk 5 2 10 

Event - med risk 5 2 10 

Event - high risk 5 2 10 

Load in / Load out 5 2 10 

Non event mode 5 1 5 


Figure 13: SMG's “First Aid Injuries: Multiple and Major Injuries caused by Explosions” 
risk assessment?”? 


6.21 


6.22 


3 


Ww 


Another part of the Operational Procedures document contains a section 
devoted to control measures.*** None of those listed are focused on 
preventing a terrorist attack. It also contains a section headed “Bomb and 
Terrorist Threats".**? This section does not list any control measures relevant to 
mitigating the risk of a terrorist attack. Nor does it mention PBIEDs. The only 
way in which its content is relevant to what occurred on 22"9 May 2017 is in 
relation to actions after a detonation had taken place. To the extent other parts 
are relevant to 22"4 May 2017 they, too, are relevant to the response to an 
attack, not preventing it. 


Overall, the Operational Procedures document fails to adopt a rigorous 
approach to the assessment of the risk of a terrorist attack. It is entirely 
deficient in relation to the key question which automatically arises once the 
extent of any risk is identified, namely what steps should be taken to reduce it? 


° INQO01359/18 


340 Extract of INQ001359/18 
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6.23 


James Allen agreed that the approach within these important risk assessments 
was not “particularly rational"***. He agreed that giving the same overall 

risk score to scenarios in which the risk was different was “nonsense”.**4 
Overall, the thrust of his evidence was to accept that these risk assessments 
were inadequate.**° Miriam Stone accepted they were inadequate.*“° They were 
both right to do so. 


In the event, the inadequacy of the risk assessments within this document made 
no difference. This is because neither of the key SMG employees, James Allen 
and Miriam Stone, used them in practice.**” 


Manchester Arena Security Risk Analysis document 


6.24 


6.25 


6.26 


6.27 


SMG prepared a document entitled “Manchester Arena Security Risk Analysis" 
(the Security Risk Analysis document). Although not explored during the oral 
evidence, SMG disclosed this document to the Inquiry before the oral evidence 
hearings began. The date on the face of it is after the Attack. However, the 
Solicitor to the Inquiry was informed by SMG in correspondence that it predated 
22™ May 2017 and that the date appearing on the first page indicated the day 
on which it was printed after the Attack. The document itself refers to the JTAC 
threat level as being ‘severe’. 


In SMG's Opening Statement it was accepted that there were “shortcomings” 
with this document. SMG went on to concede, about both the Security Risk 
Analysis document and the Operational Procedures document, “We also accept 
that they were not being reviewed with the appropriate frequency at the time of 
the Attack. In fact, neither of these documents was being used as part of the day 
to day process of terrorism risk assessment at the Arena in the period running 
up to the Attack. “**° 


The Security Risk Analysis document included an assessment of the risk of 
“Terrorist Threats outside Manchester Arena” which were “[i]Jn close vicinity 
which could affect the building directly or prevent an event taking place.” Of this 
particular threat, the document goes on to state in the notes to this assessment: 
“This is potential high due to the fact we are a city centre building within a 
major interchange railway station. WORLD RENOUNED venue operated by US 
Company and many American acts. “3*° 


This risk assessment goes on to conduct an initial likelinood-times-severity 
score, with the likelinood score initially equivalent to “medium”. The likelinood 
score is reduced to “low” following the identification of certain controls 
measures, including ‘police intelligence” and “good site wide CCTV". 


343 90/91/16-21 
$4 90/90/18-92/3 
345 28/147/17-149/11, 29/129/15-29/131/8 
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6.29 


6.30 


6.31 


6.32 


6.33 
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A number of risk assessments in relation to scenarios within the Arena are 
subsequently set out. 


The document continues by stating, under the heading “Major Risks”, that 

“[tIhe above risk assessment has identified 3 major areas of concern that 

despite the risk reduction in place it is difficult to fully bring these down to an 
acceptable level without restricting our business flexibility.” Of those three major 
areas of concern one is said to be “The location of the Arena within a railway 
interchange of a major European city with little control on what takes place 
outside and around the building. °° 


The Security Risk Analysis document concludes with three appendices. The first 
of these includes a number of the elements of the Operational Procedures 
document | have identified. The two further appendices relate to SMG and 
Showsec's recruitment of staff.°* 


It was a significant failing that SMG did not have regard to the content of the 
Security Risk Analysis document as part of the process of risk assessment in the 
period prior to the Attack. The concession that there are “shortcomings” with it 
was appropriately given. However, in my view, the threat of an attack in close 
vicinity to the Arena building, which could affect it, included the scenario of an 
IED in the City Room. This threat was stated to be a ‘potential high” risk. The 
document identified that the reasons for this risk level were the Arena’s iconic 
status, the fact it formed part of a transport hub, its American ownership and the 
fact that “many American acts” performed there. Ariana Grande is an American 
act. An event specific risk assessment, undertaken with this part of the Security 
Risk Analysis in mind, would have led to a recognition that the areas immediately 
outside the concert on 227 May 2017 may be a particularly attractive target for a 
terrorist, as in fact was the case. 


The document recognised that one of three challenges to bringing the risk 
down to “an acceptable level” was the lack of control over access by members 
of the public to the areas outside and around the Arena. This challenge is 
precisely why pushing out the security perimeter would have brought greater 
protection to event-goers. The recognition of this challenge should have driven 
attempts to move the security perimeter beyond the City Room. SMG should 
have been doing all it could to bring this risk down below an acceptable level. 


Alternatively, in the absence of achieving a security perimeter which protected 
the areas immediately outside the Arena, such as the City Room, the recognition 
of this particular challenge should have caused SMG to consider more closely 
what other mitigation measures could have been put in place. The CCTV system 
in areas of particular risk, such as the City Room, should have been scrutinised 
with this particular challenge in mind. Security patrolling, as a further means 

of identifying those who may be using the public right of access as a cover for 
their malign intent, should have received more attention. 


350 INQO001442/6 
351 INQO01442/7-36 
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6.34 Asit was, the Security Risk Analysis document did not form part of SMG's day to 
day process of risk assessment in the period prior to the Attack. Consequently, 
the important parts of this document identified above, which were capable 
of making a difference to the events of 22"? May 2017 had they been acted 
upon in the way | have described, did not receive the attention from SMG they 
should have. 


Ariana Grande concert: event-specific risk assessment 


6.35 SMG prepared a document entitled “Manchester Arena — Event Risk Assessment 
specific to the Ariana Grande concert".*** This involved the completion of a 
pro forma risk assessment with event-specific information. This was a standard 
document produced by SMG for each event. 


6.36 Atno point in this document is the threat from terrorism identified as a 
potential hazard.*°* James Allen and Miriam Stone both accepted it should 
have been.*°> Miriam Stone went further and candidly accepted that the 
event-specific written risk assessment process had descended into a box 
ticking exercise.*°° She also accepted that the system SMG had in place for risk 
assessment was less than ideal.°°” 


Sharing of risk assessments with Showsec 


6.37 Showsec’'s Service Delivery Management document envisaged that SMG would 
provide its risk assessments to Showsec.*°8 Showsec Regional Manager, Thomas 
Bailey, had no recollection of having received either a risk assessment or any 
method statements from SMG.*? Neither had Thomas Rigby, the Showsec Head 
of Security at the Arena on 22™4 May 2017.%©° 


6.38 Mark Harding stated that the arrangement between SMG and Showsec 
envisaged an exchange of information between the two organisations from the 
risk assessments. He stated that it would have been prudent for each to have a 
copy of the others’.%¢ 


6.39 Although the event-specific risk assessment was used by SMG as the basis to 
calculate the number of Showsec staff required,*©? it was not a document that 
Thomas Bailey had ever seen.*° 


352 INQO01567/1 
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358 INQO12054/14 

359 33/28/24-30/14 
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Effect of SMG's approach to written risk assessments 


6.40 


6.41 


6.42 


Both James Allen and Miriam Stone asserted that despite the accepted 
deficiencies in the written risk assessment process, SMG did adequately take 
into account the threat from terrorism in its operation.** | do not accept that. 
A more rigorous approach would have compelled greater thought by SMG. 
This should have led to a realisation that something needed to be done about 
the risk of attack in the City Room. A more rigorous approach would have 
prompted closer examination of Showsec’s documents. 


The importance of the failings | have identified in SMG's operation, such as the 
approach to CCTV and the lack of any proper investigation into the possibility of 
moving the perimeter, would have been revealed by an effective risk assessment 
process. That is the purpose of such an assessment. It would also have led 

to the identification of the importance of patrolling the City Room and the 
mezzanine area by Showsec. This may well have led to the discovery of the 
breakdown in communication between SMG and Showsec about the extent 
and function of the pre-egress check. | shall return to the pre-egress check in 
greater detail later in Part 6. 


Overall, SMG's approach to risk assessment as it related to terrorism 

was inadequate. | agree with Miriam Stone that SMG should have sought help.*°° 
| agree with Dr BaMaung that the absence of such help was a “key weakness" 

of SMG's approach.*°° SMG's approach to counter-terrorism risk assessment 
would have substantially benefited from the expert input of the kind | addressed 
in Part 5. 


Showsec 


Written risk assessment: counter-terrorism 


6.43 


Showsec had a number of risk assessments in spreadsheet form. These included 
a section focused on the threat from terrorism. The risk assessment spreadsheet 
was dated 9*" January 2017. The risk assessments contained within the 
spreadsheet were not event-specific.*°” The template was created by Sharon 
Pates, Showsec’s health and safety officer.%°° 2017 was the first time it was 
used.°°? It was completed by Thomas Rigby.*”? Thomas Rigby had undertaken a 
health and safety risk assessment course in 2011, although that did not involve 
any training in relation to counter-terrorism.*”* The spreadsheet was marked for 
review on 9" January 2018.°” 
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6.44 


6.45 


6.46 


6.47 


6.48 


Upon completion of the spreadsheet on 18" January 2017, Thomas Rigby 
emailed it to Sharon Pates and Thomas Bailey for “thoughts and changes”. In the 
body of his email, Thomas Rigby raised his concern that it didn't “look extensive 
enough to be correct.” On 24" January 2017, Sharon Pates replied to Thomas 
Rigby “All good Tom" .*” Thomas Bailey did not propose any alterations to it.*” 


The completed spreadsheet is marked as being circulated to Miriam Stone 

and James Allen at SMG and Thomas Bailey, Alan Wallace and Sharon Pates at 
Showsec. James Allen accepted he had seen this document.*” Miriam Stone 
stated she was unable to find any record that she had received this document.*”° 
| find that she did not see a copy of it prior to the Attack. 


The risk assessment spreadsheet comprised two parts.*” The front sheet of 
the spreadsheet contained the summary, incorporating the outcome of a 
number of risk assessments across Showsec’'s activities.*’”® The second part 
comprised further sheets which contained risk assessments for the different 
categories summarised in the front sheet. This included a risk assessment 
which corresponded to counter-terrorism entry on the front sheet.3”? That risk 
assessment Is four pages in length and identifies seven hazards. 


The counter-terrorism risk assessment provides for scores to be given to each 
of the hazards under the headings “Severity”, “Likelinood" and “Population”. 

A person completing this assessment was expected to input a value in relation 
to each of these fields for each of the hazards. The document then required 

a reassessment of these headings in light of additional control measures.%°° 
Once the fields were completed, the form calculated an average score taken 
across each of the hazards.**' The average score was then automatically carried 
across into an overall risk rating for terrorism on the summary page.%°? 


As a result of the way the form was completed prior to 22"? May 2017, the 
overall risk rating for the terrorism risk was indicated in the summary sheet to 
be a score of 12. According to the summary sheet, a score of 12 corresponds 
to an overall risk rating of “Low”. The form also records that the "Threat Level" 
was “Low”.°8 This is despite the fact that the national threat level was "Severe" 
at the time the assessment was completed. Thomas Bailey described this as 
being “a typo".*°* Thomas Rigby accepted that the document contained an 
inappropriately low assessment of the risk of terrorism. 
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The failure of Thomas Bailey, Sharon Pates, from whom | have not heard but 

to whom | gave an opportunity to respond to this criticism, and James Allen to 
notice such an obvious and significant error reveals a lack of care and attention 
on their parts towards their duty to identify and take steps to mitigate the risk of 
a terrorist attack. On the SMG side, James Allen accepted, and | agree, that he 
“should have taken more notice” of this document.*®° 


The aggregating of all risk assessments across all hazards to create an average 

is obviously problematic. This is so because the very low risk of particularly 
unlikely forms of attack could result in artificially depressing the final overall 
number. This might have the effect of concealing the significance of a threat 
from the most likely form of attack.*°° As a result of the approach that was taken, 
the assessment of the risk of a terrorist attack was inappropriately low in this 
document.*®” As a matter of common sense and, as should have been obvious 
to Showsec, the most likely form(s) of attack should have been used to drive the 
overall assessment of risk. 


There are three further and significant problems with this document. 


First, Thomas Bailey and Thomas Rigby asserted that it was an assessment 
focused on Showsec employees.**° This was consistent with the position 
adopted on Showsec's behalf in the opening statement.*% It was consistent 
with the other risk assessments which formed part of the overall document. 
The Showsec Operational Plan 2017 refers to a risk assessment for Showsec 
staff in relation to events.*°° The summary page of the risk assessment 
document refers to reading it “in conjunction with the Operating Plan”. 

It seems likely that this document was created as a supporting document to the 
Operational Plan 2017, which indicates it is focused on employees. 


However, the counter-terrorism risk assessment identifies members of the 
public as a category of persons who may be at risk in relation to a number of 
hazards.**' The inclusion of people beyond those employed by Showsec as 
people at risk suggests that some thought had been given to members of the 
public, although not in anything like a rigorous way given where It has been 
included. The lack of clarity around who this document was intended to benefit 
is unsatisfactory and indicates a lack of proper thought. 


Thomas Bailey confirmed that there was no other equivalent document for 
event-goers.*?? He stated that Showsec relied upon SMG to conduct such 
a risk assessment, although he never saw any such document.*% | find that 
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this was a substantial and serious omission on Showsec’s part. Showsec was 
under an obligation to conduct a risk assessment in relation to event-goers. 

It was mandatory for Showsec to carry out, in writing, a suitable and sufficient 
assessment of the risk from terrorist attack. Although Showsec failed to conduct 
a suitable and sufficient written risk assessment of this sort, | accept that 

there was some, albeit inadequate, consideration by Showsec of the threat of 
terrorism to event-goers, which | will consider further below.*%4 


6.55 Second, the attack methodology of PBIED is not listed as one of the hazards in 
the ‘employee risk assessment’, although some other attack methodologies are. 
Given that PBIED was a well-known attack methodology in 2017,%%° | find that 
this omission reveals a substantial lack of care and attention on the part of 
Thomas Rigby. This omission was not identified by anyone else within Showsec 
in the period from January 2017 until the Attack. That fact reveals a worrying 
lack of oversight at a senior level within Showsec in relation to what should have 
been treated as a very important part of its operation. 


6.56 There isa third problem with this document. At the top of the second part 
of it, two questions are posed: “Has the vulnerability risk assessment been 
completed by CTSA?" and “Has the CTSA recommendations been actioned?" .3°° 
Both of these questions are answered on the form as “Y". In fact, Showsec 
was never provided with any written information from the CTSA process. As a 
result, Showsec was not provided with any detail in writing in relation to what 
recommendations had been made and relied upon an oral report from SMG 
which was limited and omitted key information.%?” 


6.57. Thomas Bailey accepted that the answer to the second question was not based 
on any information provided by SMG.%°8 | regard this as being unsatisfactory and 
unacceptable. If Showsec wished to take into account the outcome of the CTSA 
process when assessing the risk to its own employees, which would have been 
appropriate, a request for the underlying documentation and/or involvement 
in the CTSA process should have been made. Answering an important question 
on an important document, such as a risk assessment, on the basis of what was, 
at best, an assumption reveals a lack of proper and appropriate thought being 
given to ensuring adequate steps were taken to protect people from the threat 
of terrorism. 


6.58 Overall this document, as it related to the threat from terrorism, was 
inadequate. | accept that assessing the risk of a terrorist attack is a challenging 
process which may require an adjustment to the approach which is taken 
in relation to other risks to health and safety. | also accept that there was 
not readily accessible, free guidance on how such risk assessments may 
be satisfactorily completed. However, the nature and gravity of the errors 
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in this document and Showsec’s approach to the risk assessment process 
generally lead me to conclude that insufficient regard was given to the threat 
from terrorism by Showsec as an organisation. Showsec’s staff should have 
realised the limitations of their own competence and, if they felt that there was 
insufficient freely available information, they should have made a concerted 
effort to obtain expert input. 


Counter Terrorism Awareness 2017; Manchester Arena document 


6.59 


6.60 


6.61 


Thomas Bailey reviewed and signed off “Counter Terrorism Awareness 2017; 
Manchester Arena”, a document dated 6 January 2017.%°° Thomas Rigby 

is recorded as the primary contact for this document. He was involved in 

its creation.4° It was sent to key Showsec personnel and to Miriam Stone and 
James Allen of SMG.4° 


Although not expressly labelled as a risk assessment, parts of the document do 
support a risk assessment process. Thomas Rigby said that it was intended to 
support the risk assessment process.*” It does so by identifying the measures 
which are being deployed to control the threat from terrorism. It was asserted 
on Showsec's behalf that this document “set out how Showsec delivered on its 
limited counter-terrorism obligations" .*° 


Under the heading “Security Planning” the document addresses the number of 
personnel required to ensure the safety of the public. It states: “Consideration 
of Risk assessment, audience profile, Artist Risk assessment, Capacity/Sales 
will determine the safe requirement”.*™ It does not mention the national threat 
level. Thomas Bailey stated these were the factors “on SMG side" for allocating 
the number of Showsec staff to an event. He stated this was determined by 
SMG‘s risk assessment which he never saw.*°° As set out above, SMG's event 
risk assessment did not include any consideration of the threat from terrorism. 
Thomas Bailey accepted that confusion may have entered the process in 
relation to the risk of terrorism and the risk the audience posed to itself.4°° 
This was undoubtedly the case. The thinking around risk was focused on the 
trouble an audience might cause. It did not consider in any satisfactory or 
rigorous way what the risk to the audience might be from those who may wish 
to do them harm. 
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6.62 


6.63 


6.64 


6.65 


6.66 


6.67 


6.68 


The document deals at an early stage in general terms with the “Physical 
Security” which Showsec put in place to mitigate the threat from terrorism.*°” 
As part of this section, the document identifies, correctly in my view, that one 
important measure to mitigate this threat is patrolling. 


| recognise that it would be inefficient and undesirable for a patrol to 

focus only on counter-terrorism. Such an approach may result in other 
suspicious behaviour, such as a person showing an unlawful interest in 
children, being overlooked. Consequently, it seems to me that it would be 
potentially misleading to refer to patrolling of the type | am describing as a 
counter-terrorism patrol. | think it is better described as a ‘security patrol’. 

Such a patrol should include a counter-terrorism element, but will include 
active and conscious vigilance for all suspicious behaviour. | shall deal in further 
detail with patrolling as a counter-terrorism mitigation measure later in Part 6. 


The patrolling section of the document includes: “As well as designated patrols 
each steward is responsible for their immediate working area, the total of which 
will cover the entire working area of the event/venue. Supervisors will undertake 
regular patrols of their sectors as further observatory patrols.” It also refers to 
the SMG patrols on non-event days and states “during events these patrols are 
undertaken by Showsec Security staff." 


Given the way in which it is framed within the document, | find the natural 
meaning of this passage includes the City Room. First, because the SMG patrols 
included the City Room and the use of the word “these” can only mean in 

this context that Showsec was indicating it will undertake the patrols which 
replicated the SMG patrols. Second, because the City Room falls within the 
area encompassed by the supervisors’ “sectors”, in relation to which it is said 
there will be regular, observatory patrols. Third, because this part is dealing with 
“the entire working area of the event/venue" which includes the City Room. 


This interpretation is consistent with the recognition in the NAA and EAA 
presentation given by Mark Logan and Simon Battersby that external patrolling 
was part of the counter-terrorism security operation. 


However, the difference between the plain meaning of the document and 
the way Showsec approached its activity at the Arena became clear during 
the evidence. 


Thomas Bailey agreed that the natural meaning of this part of the document 
was that Showsec would conduct patrols which would have included a 
counter-terrorism element of the whole of the City Room.*°° However, in fact, 
Showsec did not approach its work in the City Room in this way.*°? 
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6.69 That Showsec had not recognised the need to conduct security patrols 
of the City Room is found later in the same document. The City Room is 
specifically addressed. The threat of a suicide bomber in the City Room is 
identified. Anumber of “Control measures’ are listed. None of the control 
measures listed include the use of security patrols of the City Room.*?° This 
absence is consistent with the pre-egress checks which Showsec in fact 
carried out, none of which could properly be characterised as a patrol with 
a counter-terrorism element of the City Room. Omitting patrolling which 
included a counter-terrorism element of the City Room as a control measure 
was a serious failure, particularly in circumstances where Showsec had identified 
earlier in the document the importance of patrolling as a mitigation against 
the risk of terrorist attack both in the same document and in the NAA and EAA 
presentation given in April 2016. 


6.70 Thomas Bailey recognised that, even prior to the terrible events on 22 May 
2017, the use of patrols was an “obvious” control measure against the threat of a 
PBIED in the City Room.*" His explanation for its absence in the relevant part of 
this document was that the focus was on the crowd and where it went.*”? 


6.71 A further deficiency with this document relates to the inclusion of the 
pre-egress check sheet in Appendix 2. This appendix relates to searching in the 
event of a bomb threat. Included within it was the pre-egress check sheet.* 

It emerged that it had been included in error and was said by Showsec to have 
had nothing to do with counter-terrorism.*% The explanation for this error was 
that the pre-egress sheet appeared on the back of a relevant document and the 
scanning process when the Counter Terrorism Awareness 2017 document was 
created had incorrectly included it.**° 


6.72 The inclusion of the pre-egress sheet was an easily avoidable mistake. It was 
also a highly unfortunate mistake as it was capable of giving rise to the false 
impression that Showsec’s pre-egress check was a counter-terrorism patrol or 
a patrol including a counter-terrorism element. On the face of the pre-egress 
sheet, this was a patrol which included the “entire” City Room. Senior SMG 
personnel said this is what they thought was, in fact, occurring.**° None of them, 
though, drew attention to the inclusion of the pre-egress sheet in the Counter 
Terrorism Awareness 2017 document as giving rise to that belief. 


6.73 It was asserted on Showsec’'s behalf that the purpose of sending this document 
to SMG was “so that SMG could understand how Showsec was addressing this 
aspect [the counter-terrorism procedures] to secure the safety of the event 
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goers."*”” As such, it was highly unfortunate that a plain reading of it would be 
likely to mislead the reader into believing Showsec was undertaking patrolling 
that in fact it was not. 


6.74 The failure to include patrolling as an express control measure against the risk of 
a suicide bomber in the City Room is a substantial deficiency in this document. 
Insofar as the document might be thought to support the risk assessment 
process, it was insufficient and unsuitable by reason of this obvious and 
significant omission. 


6.75 Showsec’s approach to this document is a good demonstration of the 
importance of the role of proper risk assessments. Although the document 
appears to recognise the importance of patrolling, when considering the 
specifics of the City Room, that measure is entirely overlooked. Had it been 
recognised and included when this document was drawn up, as it should have 
been, a proper system of patrolling would have been implemented in the City 
Room by Showsec. This would have included patrolling on the mezzanine level. 
This is likely to have led to the identification of SA as suspicious prior to 22:15 on 
22™ May 2017. 


Ariana Grande concert: event-specific risk assessment 


6.76 The Ariana Grande concert appeared in a document which listed a number of 
events under the heading “Event Risk assessment category’. In that document, 
the Ariana Grande concert was identified as being an “Event Category A’. 
This event category is identified as being “low risk".4*® 


6.77 __|t became apparent in the course of the evidence that the phrase “Event Risk 
assessment category" was a reference to the process by which the minimum 
required seniority, experience and education of the Head of Security for an 
event was identified.4"? Documents of the type which included the Ariana 
Grande concert were usually completed quarterly.*#° This meant that some 
events would be considered in excess of two months prior to taking place.*74 


6.78 Thomas Rigby, who was Head of Security for the Ariana Grande concert, 
accepted it was not a risk assessment.*”* The selection of the Head of Security 
process did not include any assessment of the threat from terrorism to 
the event.*?? Showsec has since renamed this process better to reflect its 
true objective.*~4 
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6.79 There was no written risk assessment prepared by Showsec specific to the 
Ariana Grande concert which included assessing the risk to attendees from 
terrorists. There should have been. Assessing each event individually for all 
risks should have been part and parcel of Showsec’s standard way of operating. 
When done correctly, the risk assessment process should refocus attention on 
the control measures which will be required. This should affect the content of 
the briefings. 


6.80 Showsec have since commissioned another company to assist in the carrying 
out of its risk assessment for terrorism.42° 


Communication, coordination and co-operation 


6.81 §=SMGand Showsec should each have taken into account the steps being taken 
by the other when conducting risk assessments. Showsec needed a very clear 
understanding of what SMG were doing in relation to CCTV because CCTV 
played an essential role in the overall counter-terrorism strategy. SMG needed 
a very clear understanding of what Showsec was doing in relation to patrolling, 
for the same reason. The necessary level of communication, coordination and 
co-operation was not achieved. 


6.82 Both SMG and Showsec needed to know BTP’s deployment plan for each and 
every event. That way, both could plan on the basis of what they knew BTP 
would be doing.*”° This would have provided the opportunity to discuss and 
plan for the situation where BTP did not do as expected. Again, what should 
have occurred, did not. 
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Key findings 


SMG 


e SMG should have ensured that its CCTV operators had SIA CCTV 
monitoring licences. 


e SMG provided inadequate training to its CCTV operators in relation to 
counter-terrorism. 


e SMGQ's senior staff had undertaken adequate general training in 
counter-terrorism. 


e« SMG did not provide adequate CCTV-specific counter-terrorism training for its 
senior staff, despite requests from both people who should have received it. 
This was a significant failure. 


Showsec 


e The content of Showsec’s online training for its stewards in relation to 
counter-terrorism was capable of improvement but was adequate. 


e Showsec should have followed up this online training with practical, 
person-to-person training, which checked that the online training had been 
understood and built confidence around the reporting of concerns. 


e Showsec should have made counter-terrorism refresher training compulsory 
for stewards. 


e Showsec’s procedures for ensuring that counter-terrorism training had been 
understood by its stewards were inadequate. 


e Had Showsec taken robust steps to ensure that all of its staff had completed 
their training diligently, provided a practical opportunity to demonstrate 
their Knowledge and build their confidence, it is possible that either or both 
Mohammed Agha and Kyle Lawler would have acted more decisively to escalate 
Christopher Wild’s concerns regarding SA. 


e The role occupied by Mohammed Agha on 22" May 2017 required specific 
training. Mohammed Agha did not receive adequate training in that role. 
This reduced the prospect of him responding appropriately and robustly to 
Christopher Wild's concerns. 


e There was confusion about the functionality of the radios issued to some 
Showsec staff. 


e Showsec staff should not have been used to monitor SMG's CCTV during events: 
they lacked the necessary SIA licence, training and experience. 


e Showsec took adequate steps to ensure that its senior operational staff had 
sufficient counter-terrorism training. 


SMG and Showsec 


e While it reflects well on both SMG and Showsec that they undertook joint training 
exercises, they did not do so in relation to counter-terrorism. 
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SMG 


CCTV operators’ counter-terrorism training 


6.83. SMG required its CCTV operators to have an SIA door supervisor's licence.47” 
However, SMG's CCTV operators did not undertake the CCTV component of 
the SIA licence.48 The SMG employees should have undertaken such training. 


6.84 | cannot say that the absence of SIA CCTV training for the SMG CCTV 
operators made any material contribution to events on 22™ May 2017. But it 
reveals a lack of care on the part of SMG towards an important aspect of its 
counter-terrorism strategy. 


6.85 SMG provided in-house training for its CCTV operators across a number of 
areas.*° That training did not include any significant CCTV counter-terrorism 
element, such as in relation to the identification of hostile reconnaissance 
or activity which may be an immediate precursor to a terrorist attack.*%° 
Given the importance of CCTV as a counter-terrorism measure, this was a 
substantial deficiency. 


6.86 Paul Johnson, the SMG Security Supervisor, stated that he asked SMG to provide 
CCTV-specific training more than once. He stated that “a couple of control 
room operators” asked him for such training. He was told by SMG that because 
it was not a legal requirement, CCTV-specific training was not necessary.** As a 
result, Control Room Operators did not receive SIA CCTV training. 


6.87 | accept that Michael Edwards, who was the Control Room Operator in Whisky 
Control on 22"4 May 2017, did have a general understanding of what hostile 
reconnaissance was. | also accept that he understood that his role involved 
looking out for what he regarded as suspicious.** Despite this, | was struck by 
the fact that in 11 years of acting as Control Room Operator, Michael Edwards 
had never once suspected that he was observing anyone engaging in hostile 
reconnaissance.** This was a product of the lack of adequate training and the 
shortcomings in the CCTV system. | address both of these later in Part 6. 


SMG senior staff's counter-terrorism training 


6.88 James Allen, Miriam Stone and Paul Johnson had all received Project 
Griffin training.*** Like Project Argus, Project Griffin was a training module 
provided by NaCTSO. While Project Argus was “focused more at a strategic 
level", Project Griffin was “focused at more of a ground level in terms of those 
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6.89 


6.90 


people delivering security".43° Miriam Stone and Paul Johnson also attended 
Project Argus training.*%° James Allen undertook the Showsec stewards’ 
counter-terrorism module.*%” Paul Johnson had undertaken the SIA door 
supervisor training and had held an SIA licence for this activity.*°° All of these 
represent good practice by SMG. 


Where SMG should have done better for their senior Arena staff was in relation 
to CCTV. Both Miriam Stone and Paul Johnson's responsibilities included the 
viewing of CCTV during events. Both Miriam Stone and Paul Johnson requested 
external CCTV training. Both were told that this training was not a legal 
requirement. As a result, both were told that they could not have that training.*°? 


| address the confusion caused by SMG's corporate structure and SIA licence in 
Parts 2 and 3. Setting the legal position aside, it was obviously highly desirable 
that both Miriam Stone and Paul Johnson received proper training in the use of 
CCTV from a counter-terrorism perspective. They were the most senior SMG 
personnel in Sierra and Whisky Control. It was a significant failure in SMG’s 
training regime for its senior staff that no CCTV-specific counter-terrorism 
component was provided. That this failure occurred, despite the fact that 

both relevant people were requesting this training, makes this failure all the 
more serious. 


Showsec 


Online counter-terrorism training for stewards 


6.91 


Showsec had its own bespoke online e-learning platform which it had 
developed in collaboration with Derby University from 2011.**° There are 
approximately 60 to 70 online courses available on the platform.*** 

Showsec required all staff to undertake six modules from the online training 
before they started in their role as a steward.*** One of these was a module 
devoted to counter-terrorism.**3 There were additional modules which could 
be undertaken as a steward’s duties required once they had commenced work, 
including one specific to the Manchester Arena.**4 
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The counter-terrorism module was entitled “Counter-terrorism at Events”.4*° 

It consisted of a series of webpages with information relevant to the 
identification of hostile reconnaissance, the UK threat level and a link to the 

MI5 website.*“° It provided examples of terrorist attacks which had taken place in 
other parts of the world.**%” 


The training also provided links to NaCTSO-prepared training videos: Operation 
Fairway and Eyes Wide Open.**® Operation Fairway was described in the training 
text as containing “very important and relevant" information to the module.4*? 
One of the key measures of the Eyes Wide Open videos was having “the 
confidence to report suspicious incidents."*°° The inclusion of these two videos 
was an example of good practice by Showsec. Showsec anticipated that the 
whole module would take approximately 45 minutes to complete.** 


Guidance was provided at the start of the module which stated the following to 
those undertaking the training: 


“Your vigilance is essential to ensuring protective measures are kept. 
Stewards/SIA staff will know their work areas very well and therefore maybe 
better identifiers of risk than their supervisors or line manager. It is therefore 
essential workers alert any unusual behaviour or items out of place to 

their supervisor. Workers should be confident speaking to their supervisors 
if they believe there is suspicious activity on the premises and should 
understand the importance of reporting these (even if it is a false alarm). “#2 


This was an appropriate way for the training to begin as it emphasised the 

twin key messages to staff of the need for vigilance and having confidence 
raising matters with their supervisors. There was insufficient evidence for me 

to determine whether or not Showsec’s training generally was better than that 
provided by other similar organisations at the time. However, | do regard this as 
an example of good practice within the online counter-terrorism training. 


The training included reference to “patrolling” as being one of the measures 
that might be taken to “help reduce the chance of a terrorist attack’ .4°° 

This is a further example of Showsec correctly identifying the importance of 
patrolling as a counter-terrorism measure.*°* The inclusion of patrolling in the 
counter-terrorism module makes it all the more inexplicable that Snhowsec did 
not put this into practice in the City Room. 
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6.99 


6.100 


The Security Experts were critical of the content of the online training ina 
number of respects.*°° While | agree that the content was capable of being 
improved, it was nevertheless adequate. The target audience was Showsec 
stewards who, without a licence, were not permitted to carry out active profiling 
of audience members.*°® 


The fact that the content of the online material was adequate is not the end of 
the matter. Those undertaking the training may be doing so in their free time,*°” 
and will be using their own equipment to access the content.*°® While it was not 
unreasonable for Showsec to require its staff to do this initial training in their 
own time**? and with their own equipment, it gives rise to a number of obvious 
risks. There is an obvious and significant risk that the person doing the training 
would not be doing so in an optimal environment. They may be doing it late 

at night, others may be present while they are doing it, they may be distracted, 
they may be doing it piecemeal. There Is a risk that the person may skip through 
the content without paying any real attention. There Is a risk that they will be 
accessing it on a device with a small screen which may make absorbing the 
information difficult. 


There were a number of measures available to Showsec to improve the 
prospect that the important content of the online training was being understood 
and assimilated. The webpages could have been displayed for a minimum 
period before permitting a trainee to move on.*°° This would prevent the 
trainee skipping forwards. A knowledge test at the end of the training would 
provide an opportunity to check that the trainee understood the content. 

In fact, in December 2016 Showsec did introduce a knowledge test to the 
counter-terrorism module.** While this important improvement was in place 
several months prior to the Ariana Grande concert, it was of no benefit to those 
working for Showsec in the City Room that night. This was because all of them 
had undertaken the counter-terrorism module prior to December 20164 

and there had been no requirement to retake it once the knowledge check 

was implemented.*® 


A further check that Showsec should have implemented was the monitoring 
of the duration of the time it took trainees to complete each module. Showsec 
commissioned a retrieval of the time spent by Mohammed Agha on his training 
for the purposes of collecting evidence for the Inquiry. Following this, the 
Inquiry requested the same Information in relation to a number of other key 
Showsec employees.*®% 
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This data is not the product of a system which was designed and intended 
to monitor compliance. It is a re-creation from information which is now 
available.*°° For this reason there are limitations to this data.*°© However, | 
am satisfied that in the case of four of the 10 people for whom there is data 
available, they moved through the counter-terrorism module at too great a 
speed to properly understand its content.*° 


In the case of Mohammed Agha, he accepted that if he had attended to his 
studies properly, he would have been better informed as to how to carry out 
his duties on 22™ May 2017.468 He also stated he had not watched any videos as 
part of his training.*°? This supports the conclusion that he did not carry out the 
online training diligently. 


Showsec should have foreseen these risks and taken robust steps to ensure 
that its staff had taken on board, in a meaningful way, the critically important 
information contained within the online training. Such information was 
capable of making a large number of people much safer through the actions of 
Showsec staff. 


Once the online training had been completed, it remained available to staff to 
return to it of their own volition.*”° Showsec also had a facility to encourage 

its staff to undertake refresher training in the counter-terrorism module 

using an e-shot.*” This facility was used on 14 November 2015 immediately 
following the terrorist attack in Paris.4” It was good practice on Showsec’s part 
to recognise the need for refresher training in light of the situation in France. 
However, Showsec did not make this refresher training compulsory.*”5 
Showsec should have done so. | do not accept that the reasons given for not 
making it compulsory provide an adequate Justification given the importance of 
this information.*” | found it particularly concerning that even after the Attack, 
Showsec did not immediately mandate refresher training in counter-terrorism 
for all its staff.4” 


In addition to the counter-terrorism module, Showsec’'s portfolio of e-learning 
topics included one specific to the Arena. This served as an introduction to 
the layout, systems and terminology specific to the Arena. It was a customer 
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service-focused document.*”° It did not contain any information which 
focuses the attention of those undertaking that training on matters relevant to 
counter-terrorism when working at the Arena. 


It did, however, envisage that supervisors would have “thoroughly checked their 
working area of any issues ahead of egress" before completing a pre-egress 
report.*”” This was an appropriate and necessary procedure. It would have 

been improved by making clear what the supervisor might be on the lookout 
for. Within its own terms, though, it was an adequate description of what 
needed to occur. The City Room was one of the working areas for Showsec. 
The mezzanine was part of the City Room. The natural meaning of this sentence 
is that the City Room, including the mezzanine, would be thoroughly checked 
before egress. In practice, Showsec did not interpret this part of its own training 
as requiring a thorough check of the mezzanine for the potential threat from a 
terrorist. As a result, the check was confined to the direct route from the Arena 
concourse doors to the Fifty Pence staircase, and from the doors to the raised 
walkway to the Arena concourse doors.*”8 


Other counter-terrorism training for stewards 


6.107 


6.108 


6.109 


Showsec’s training incorporated a period in the classroom of at least half a 
day.*”? | accept that this included some element of counter-terrorism training. 
It is unclear from the evidence | heard exactly what it contained.*®° However, 

| heard no evidence that the classroom work on counter-terrorism involved 

a structured, formal and robust check that all of the online training had been 
understood. Nor did | hear evidence that there was any other testing of the 
knowledge of the individuals who participated in it.4%4 At no point has it been 
submitted on Showsec’s behalf that this training did contain this element. 


Whichever way it was done, a person-to-person interaction would have 
provided a valuable check that the message of the online training had been 
received and understood. The online training conveyed the message that staff 
should have confidence reporting concerns adequately. For this to have any 
effect on attitude, a person would need to complete this training diligently. 


It is my view that the message was sufficiently important that it needed to 

be repeated in a one-to-one setting to check it had been understood and to 
instil the necessary confidence in each and every member of staff. Everyone 

is different. Snowsec employs stewards who can be as young as 16-years old. 
While age is not a reliable indicator of confidence, a significant age gap can 
act to make some people feel less empowered to speak up. Counter-terrorism 
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is too important an activity to leave to chance. It was incumbent on Showsec 
to take adequate steps to make sure that each and every member of staff 
understood the importance of being vigilant and speaking up. 


Briefings 


6.110 
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6.114 


Showsec had in place a system for reinforcing the counter-terrorism aspect of 
the training through supervisors’ briefings*®* and steward briefings.*** The need 
for vigilance formed part of both levels of briefing. 


David Middleton, who gave the briefing to the stewards on 22" May 2017, stated 
that he included an instruction that he needed to know if there was anything 
they were not happy with.*8* However, | was concerned that his answer to the 
question as to whether he was an approachable supervisor was that he was 

“a Strict supervisor” and that he was “not there to make friends with staff" .4°° 

By May 2017, David Middleton had worked for Showsec for 21 years.*8° He had 
been a supervisor for 16 years and a senior supervisor for five years.*°” 


Mohammed Agha did not ask any questions of David Middleton, despite 

not receiving any specific instruction for the role. This was a role he was 
undertaking for the first time that night. Kyle Lawler, while accepting that he 
had real difficulty recreating his mental state from the night,*®° stated that he 
had hesitated reporting SA because of his concern about what the reaction 
might be.48? He also said that his concern was not focused on David Middleton 
but more generally that he might be accused of racism.*%° 


The culture Showsec should have been instilling in all its staff was that they 
should be receptive and approachable when it came to reports of potential 
terrorist threats. 


In any event, while it was good practice to include in the briefing both the need 
for vigilance and the need to report, it was necessary to do more than this and 
address this on an individual and personal level. As Assistant Chief Constable 
(ACC) Sean O'Callaghan recognised in the context of BTP briefings, there is 

a risk that people stop paying attention when the same message Is repeated 
every time.*9" 
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6.115 The briefings were not an adequate substitute for the diligent completion of 
the online training. A subsequent person-to-person check that the importance 
of that training had been understood and that each and every person had the 
confidence they needed should have occurred. 


Conclusion: stewards’ counter-terrorism training 


6.116 Showsec should have had in place a system which focused on each individual. 
This should have checked that they had understood their online learning 
and provided an opportunity for the member of staff to demonstrate 
that understanding. This might have been done through a short period of 
mentorship,4% through interactive classroom-based learning which set out 
to assess this in a structured way, or through on-site training as part of a 
practical scenario. 


6.117 This training should have dealt not only with what staff were looking for, but 
also how they should react when confronted with a potential terrorist situation. 
The training needed to instil in an individual the necessary confidence to report 
potential terrorist activity. 


6.118 Two Showsec employees, Mohammed Agha and Kyle Lawler, were provided 
with information arising from Christopher Wild's concerns about SA on 
224 May 2017. This information should have prompted immediate action on 
their parts. Both had been present at the briefing which included the need to be 
vigilant and to raise concerns. But neither had completed the online training in 
circumstances which ensured that they absorbed and understood it adequately. 


6.119 Neither Mohammed Agha nor Kyle Lawler reacted as robustly and effectively 
as they should have. This was because, when presented with the information, 
neither of them had at the forefront of their mind the very high degree of 
importance of doing so. Had Showsec taken robust steps to ensure that all of its 
staff had completed their training diligently and provided a practical opportunity 
to demonstrate their knowledge and build their confidence, it is possible that 
either or both Mohammed Agha and Kyle Lawler would have acted more 
decisively to escalate Christopher Wild’s concerns. | address the potential effect 
of such action in greater detail in Part 1. 


6.120 In reaching these conclusions | have not lost sight of the fact that both 
Mohammed Agha and Kyle Lawler had, in addition to their Showsec 
training, an SIA door supervisor's licence. The SIA door supervisor licence 
training included the active profiling of the crowd. This went beyond the 
level of vigilance expected of the steward role.*% It included some basic 
counter-terrorism training.4** However, the SIA training was not specific to 
working at the Arena. Nor was it specific to the hierarchy, relationships and 
personalities of those others who were working on 22"? May 2017. 
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6.121 The duty was on Showsec to ensure that all of its staff, whether SIA licenced or 
not, were adequately trained. This meant ensuring a minimum of two things. 
First, that all staff possessed the level of counter-terrorism understanding 
required of the role they were given, so that they could immediately recognise 
when they needed to act. Second, that all staff felt sufficiently confident and 
empowered in the environment they were working in, and with the people they 
were working with, to report potential terrorist threats to the right person with 
appropriate speed and clarity. 


6.122 While the training that Showsec offered may have been successful for some, if 
not many of its staff, Snowsec was under an obligation to ensure that all staff 


had taken it on board and Knew what to do. Showsec’s methods for ensuring 
this were inadequate. 


Training for the Grey Doors role 


6.123 Asset out in Part 2, Mohammed Agha was allocated to an area of the City Room 
known as the Grey Doors. This was an SIA licence-holder position. The Grey 
Doors provide access to the station platforms via the platform overbridge and 
are positioned between the two staircases to the mezzanine area. The location 
of the Grey Doors within the City Room appears in Figures 14 and 15. 
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Figure 14: Plan showing location of the Grey Doors in the City Room*” 
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Figure 15: Photograph showing location of the Grey Doors in the City Room*° 


6.124 Mohammed Agha had never previously been deployed to this position.*%” 
He was not briefed by any supervisor as to exactly what his role was but was 
told that he should not leave the Grey Doors unless they were covered by 
another member of staff or in the event of an emergency.*%° He received a brief 
explanation as to what his role involved from another steward. This explanation 
was to the same effect as the supervisor's briefing.*°? He received no written 
instructions in relation to this role, despite the requirements of SMG (UK)'s 
premises licence.°°° This was an obligation on SMG, not Showsec. However, 
the idea which gives rise to the licence condition is a good one. | make clear, 
though, that | am not criticising Snhowsec for a failure to provide Mohammed 
Agha with written instructions in relation to his role on the Grey Doors. This was 
just one of a number of ways which was open to Showsec to make sure he 
knew what he was doing. 


6.125 The position on the Grey Doors was unlike other positions by fire doors: they 
were key operated doors, which automatically unlocked in the event of a fire 
alarm, the function of which was to prevent access to the platform side of the 
barriers on the station concourse.°™ As such, the Grey Doors did not present 
the same security risk as other fire doors. Consequently, that position required 
a specific briefing for a person undertaking it for the first time. That briefing 
should have made clear that there was greater scope for Mohammed Agha to 
move away from them than was the case for other fire doors. 
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6.126 Mohammed Agha received no specific training on how, when in the Grey Doors 
role, he should have escalated any concern raised with him by a member of 
the public. | heard no evidence to suggest that this lack of detailed instruction 
was a one-off oversight on Showsec's part. Rather there was a failure to 
appreciate the need for such training. The training would have provided an 
opportunity to discuss with the person what their role involved. In turn, this is 
likely to have built the confidence of that person in knowing how to respond to 
a variety of situations they may be presented with, including a report of potential 
terrorist activity. 


6.127 Mohammed Agha did not receive adequate training in his role in front of the 
Grey Doors. His training was capable of leading him to believe that it was 
more important to remain where he was than in fact was the case.°” In turn, 
this reduced the prospect of him responding appropriately and robustly to 
Christopher Wild's concerns. 


Training for Showsec radio holders 


6.128 Some members of Showsec staff were issued with radios. On 22™ May 2017, 
Kyle Lawler was one such person.°°3 The radios were supplied by SMG.°°* 
In addition to the standard talk function, the radios had another button on 
the top.°% 


6.129 Thomas Bailey, one of the two Showsec Heads of Security, understood this 
to be an “emergency button” which, when pressed, would cause the base 
station in Sierra Control to beep against the assigned call sign.°°° He stated 
that this had only occurred once in his experience, when the button had been 
pressed by accident.°°” He stated he did not know if the radios had an “override” 
function.°°° Thomas Bailey recognised, however, that his understanding of this 
function was limited. He stated that he had never seen any supervisor provide 
training in its use when telling staff how to use the radios.°°? He accepted that 
if the function was used infrequently staff would lose familiarity with it*° and 
that staff should have received regular training in its use.*"t He also accepted 
he should have had a better understanding of it, but asserted that there were 
differences between handsets.°? 
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6.130 Paul Johnson, SMG Security Supervisor, expressed the view that he did not think 


Showsec knew anything about this button and that he did not think Showsec 
staff had been told about the button or trained in its use.°44 He expressed 

surprise at Thomas Bailey's evidence.°“ Paul Johnson said that the button was 
for his staff when patrolling alone.*** Paul Johnson's account of this button’s 


function was that when depressed it would broadcast for 10 seconds “right over 


the channel it’s on".>*6 


6.131 Jordan Beak described a process in which a user “cut in" to a conversation 


6.132 


to say they had a “priority message”. This, he said should cause people to 
stop their broadcast.°”” If that did not work, he stated the radios had a red 
button which when pressed “cuts everybody else and communicates only 
your radio."*'8 


David Middleton described pressing “a button" in order to say that there was a 


“priority message’.*’? It is unclear from his account®*° whether he was describing 


the first part of Jordan Beak’s explanation, which does not involve an override 


function of others’ radios, or the use of a button the sole purpose of which was 


to interrupt the broadcasts of others. 


6.133 Kyle Lawler described his training in the use of the radio in this way: “the first 


time | was given a radio, | was shown basically how to send a message and 
to change the channel and the volume. That was pretty much it”.°*! He stated 
that he was not aware of an “override” button in May 2017.°*2 He stated he 
had seen a button on the top of the radio which he said he did not know the 
purpose of.°** He confirmed that in his statement he had described it as a 
“panic button", but that he did not know what would happen if he pressed it.5** 
He stated he did not think it worked.°*° He indicated that he had not given any 
thought to the purpose of the button.°° He also stated that he could not recall 
anybody ever using the “panic button" before.°’” The use of the phrase panic 
button is consistent with Thomas Bailey's apparent misunderstanding of the 
button’s function. Kyle Lawler’s description of his training is also consistent 
with Thomas Bailey’s.°*8 Kyle Lawler’s account, that he was not aware of the 
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functionality of this emergency button, is consistent with Paul Johnson's belief 
that its use did not form part of Showsec'’s training. It appears that Jordan Beak 
did understand what the button did. 


6.134 | accept Kyle Lawler’s evidence that he did not have a clear understanding of 
the full functionality of the radio he had during the concert. He was not aware 
of the purpose of the override button, what would happen if he pressed it or 
its ability to deliver urgent messages immediately. This was because he was 
not properly trained by Showsec in its use. This did not, in the event, make 
any difference to events on 22™ May 2017. That is because Kyle Lawler did 
not take immediate, decisive and robust action in response to learning of 
Christopher Wild's concerns because he did not appreciate the importance of 
doing so. However, Kyle Lawler’s deficient understanding of the radios did reveal 
substantial weakness in Showsec’s training. 


Showsec staff monitoring SMG's CCTV 


6.135 SMG and Showsec had an agreement that led to Showsec staff providing relief 
cover to SMG employees in Whisky Control. When this occurred, Showsec 
staff monitored the CCTV during events.**? They did this despite not having an 
SIA CCTV licence.°%° They should have had such a qualification. The confusion 
caused by SMG's corporate structure, which | have set out in Parts 2 and 3, did 
not apply when Showsec were undertaking such work. 


6.136 An explanation for this may be Thomas Bailey's belief that those Showsec 
employees would be undertaking tasks other than CCTV monitoring when in 
Whisky Control.°3* Such a misunderstanding does not, however, absolve SMG 
of the responsibility of ensuring that those who monitored its CCTV system 
were suitably qualified. Further, and quite aside from the lack of compliance 
with the SIA regime, | am not satisfied that a Showsec employee would have the 
necessary experience and training to undertake the work of an SMG employee 
whose role was to monitor the CCTV. 


6.137. The regulatory non-compliance and lack of training did not directly 
affect events of 22" May 2017, as there were no Showsec employees in 
Whisky Control. It does reveal a further example of a lack of care on SMG's 
part in relation to CCTV. This would not have occurred if SMG had approached 
CCTV as being an important counter-terrorism measure. 
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Counter-terrorism training for Showsec senior operational staff 


6.138 


6.139 


6.140 


Those in the Head of Security role held an SIA CCTV monitoring licence.°% 
The supervisors all held SIA door supervisor licences.°** Showsec was entitled 
to rely upon the SIA training as providing some information to those members 
of staff whose role included the active profiling of event-goers and potential 
threats to them. 


Showsec’s senior operational staff Thomas Rigby, Thomas Bailey, David 
Middleton and Daniel Perry had all undertaken NaCTSO Project Griffin.°** 

In addition, Thomas Bailey and Thomas Rigby, who both undertook the most 
senior operational role of Head of Security, had completed NaCTSO Project 
Argus training. 


In my view, Showsec had taken adequate steps to ensure that its senior 
operational staff had sufficient counter-terrorism training. 


SMG and Showsec 


6.141 


6.142 


Part of Showsec’s agreement with SMG was to provide “senior management, 
supervisors and key staff’ with “venue specific desktop safety exercises including 
but not limited to fire, crowd control, terrorist attack and show cancellations."°*° 
This was a responsible thing for the two organisations to agree to do. As a 
result, Showsec and SMG organised for members of staff to participate in 
tabletop exercises at the Arena.°*° Thomas Bailey and Miriam Stone created 
these exercises.°*” 


One of those exercises, which was run on 17" December 2014, involved a 
scenario of a terrorist attack in the City Room.°%® Although it was characterised 
at some points in the evidence as a counter-terrorism exercise,>*? it was not 
focused on detecting or preventing a terrorist attack.°*° The focus of this 
training was on what should occur after an attack had begun.°*" As a result, 
although it reflects well on both SMG and Showsec that they undertook joint 
training exercises, they did not do so in relation to counter-terrorism. This 
exercise scenario provided an opportunity for SMG and Showsec to think 
carefully about all the challenges presented by the City Room in the context of a 
terrorist attack. 


$32 33/50/17-19 
533, 33/15/21-16/9 
534 34/115/4-7, 33/111/20-112/1, 19/17/13-23, 23/15/12-22 


535 31/171/7-18 
536 33/86/1-5, 30/45/9-12 


537 33/85/5-6, 30/50/3-4 


538 INQO01444/1 
539 43/239/23-240/8 


540 33/87/5-23 
641 INQO01444 


110 


Part6 SMG and Showsec: terrorism threat mitigation measures 


Key findings 


There was evidence that SMG and Showsec had experience of identifying and 
responding to potential hostile reconnaissance appropriately. 


The follow-up to identified potential hostile reconnaissance was not effective 
on every occasion, in particular in response to an occasion of potential hostile 
reconnaissance by a person unconnected to SA three days prior to the Attack. 


There was an insufficiently robust system for ensuring that information about 
suspicious behaviour was always passed on and acted upon. 


Greater awareness of the potential hostile reconnaissance, by the person 
unconnected to SA, three days prior to the Attack may have caused Mohammed 
Agha or Kyle Lawler to respond differently to Christopher Wild's concerns. 

It would have increased the possibility that SA would have been noticed on 

227 May 2017. 


Hostile reconnaissance: sharing of information 


6.143 The adequacy of the SMG and Showsec training is dealt with earlier in Part 6. 


| focus here on the system which was in place for following up on potential 
hostile reconnaissance when it was identified. 


6.144 SMG and Showsec staff did have experience of identifying and responding to 


potential hostile reconnaissance effectively. Thomas Bailey told me about an 
incident when some individuals were thought to be acting suspiciously at a 
Pet Shop Boys concert in February 2017. This led to a prompt and substantial 
response. Another incident at a Jehovah's Witness conference in 2015 led to 
a BTP superintendent being deployed to the Sierra Control Room for several 
subsequent events.°42 


6.145 Brandon Couper-Philips, a Showsec steward, noticed an incident of suspected 


hostile reconnaissance on 21%t May 2017,°43 demonstrating that Snowsec staff 
were on the lookout for such issues on that evening too. It was not clear to me 
on the evidence | heard in relation to this incident, however, to what extent it 
was considered or investigated. 


6.146 The follow-up to reports of hostile reconnaissance was not effective on 


every occasion. Jonathan Lavery, a former police officer and member of 
Showsec staff, reported an Asian male “acting very suspiciously wearing all 
black with a large black bag" to the Sierra Control Room on the evening 
of 18° May 2017.°¥ This description was very similar to SA’s appearance on 
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22" May 2017, although the individual Jonathan Lavery saw was not SA, 

nor does he have any known links to either SA or HA.°*° Jonathan Lavery 
followed the individual until he got onto a train, and informed a BTP officer of 
his concerns.**° He then completed a written report of the incident which was 
collected at the end of the evening.°”” 


6.147. Jonathan Lavery’s expectation was that this report would have been brought up 
in the pre-event briefing on subsequent nights, but he could not recall whether 
this had in fact happened. He was not aware of any system In place to ensure 
that it did.°*8 


6.148 Miriam Stone thought that she had mentioned Jonathan Lavery’s report in 
her briefings to supervisors on the following evenings, in order to raise their 
awareness and encourage security staff to “keep an eye out".>*? | found Miriam 
Stone to be a generally reliable witness and accept that this was her genuine 
recollection, but there was nothing about Jonathan Lavery's report documented 
on either the supervisors’°°° or stewards’°*! briefing sheet on 22" May 2017. 
Showsec staff did not recall being informed of it.°°? Either the information was 
not passed down effectively to those providing security on that night or it did 
not make a sufficient impression on them. 


6.149 There was an insufficiently robust system for ensuring that information about 
suspicious behaviour was always passed on and acted upon. 


6.150 The Security Experts were critical of the lack of a system to ensure such key 
information was adequately disseminated, both within SMG and Showsec®*s 
and between them and the police.°** They also were of the view that there was 
not enough practical direction given to staff about how to respond to or report 
suspicious behaviour, and encouragement to act upon it.%°° Colonel Latham 
described the issue as follows: 


‘TY]lou can encourage it by, whenever anybody reports anything, no matter 
how stupid, foolish and irritating it is that they've done that, giving them 
positive public praise and reinforcement, “This guy's always reporting stuff, 
he's my best reporter’, that sort of attitude...if you encourage your junior 
staff to really do that, their job is less boring and you can be a bit more of a 
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team and it’s better customer service. But in this case, we have seen when 
these two individuals [Agha and Lawler] were pressed to test, the net result 
was that the control room didn’t find out. “256 


6.151 Colonel Latham commented that passing on reports of suspicious behaviour, 
such as that of Jonathan Lavery, was “a good way of keeping your briefings 
fresh" and encouraging others to report concerns. He agreed with the 
suggestion that, had security staff on 22"7 May 2017 been aware they should 
look out for someone dressed in black and carrying a backpack, it might have 
helped them spot someone who fitted that description.°°” 


6.152 It may be that greater awareness of Jonathan Lavery’s report of suspicious 
behaviour a few nights earlier would have caused Mohammed Agha or Kyle 
Lawler to respond differently to Christopher Wild’s concerns. Greater awareness 
would also have caused Showsec staff more generally to have been more 
vigilant in looking out for someone of a similar appearance to SA. This would 
have increased the possibility that he would have been noticed. 
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Key findings 


SMG should have sought permission from its landlord to push out the security 
perimeter before May 2017, so that people entering the City Room with large 
bags were checked before entry. 


Had permission to push out the perimeter been granted, an attack in the City 
Room would have been much less likely. SA may have been deterred from 
carrying out an attack at the Victoria Exchange Complex. 

Had permission been refused, it is likely that SMG would have looked more 
closely at other threat mitigation measures required in the City Room. 
Whether or not the request to move the perimeter beyond the City Room had 
been granted, it is likely that in at least trying to achieve this, SMG would have 
substantially improved the safety of the City Room for event-goers. 


6.153 In May 2017, the security perimeter of the Arena, so far as approaching through 


the City Room was concerned, was at the doors into the Arena concourse. 
It was at this point that large bags were searched and tickets checked. 


6.154 The Security Experts described how one method of mitigating the risk of a 


terrorist attack in a grey space, like the City Room, is to push the security 
perimeter out further. In practice, this would mean moving it to a point further 
away from the entrance doors or to have layers of security whereby large 
bags are searched some distance away from where the crowd gathers using 
equipment like x-ray machines or walk-through metal detectors.°°8 


The importance of a security perimeter 


6.155 On13" November 2015, a music concert at the Bataclan theatre in Paris was 


attacked by terrorists carrying firearms. The terrorists gained access to the 
venue and killed 89 people. This attack was the final part of a coordinated series 
of attacks that night. Those attacks began with suicide bombers detonating 
PBIEDs just outside the Stade de France. There was then a series of attacks in 
busy public spaces using firearms and a PBIED. A total of 130 people were killed 
in the course of the attacks (the Paris attack). 


6.156 On 24" July 2016, a terrorist carrying an IED attempted to gain access to an 


outdoor music festival in Bavaria. He was prevented from doing so by a security 
guard and detonated his device, killing only himself. Both Miriam Stone and 
James Allen stated that they were unaware of this attack.°°? On any view, 
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this attack serves as further evidence of the seriousness of the threat of 
PBIEDs to events like the Ariana Grande concert and the importance of the 
security perimeter. 


6.157 Some of SMG's senior staff attended a conference in April 2016. At that 
conference they were informed that following the Paris attack in late 
2015, the AccorHotels Arena in Paris had responded by pushing out its 
security perimeter.°°° 


6.158 In July 2016, SMG staff attended an Exercise Sherman training event. This was 
a training exercise provided by the Greater Manchester Resilience Forum 
and facilitated by GMP. The scenario included a marauding gunman terrorist 
attack in the City Room.°® This should have highlighted to SMG the very real 
vulnerabilities to an attack presented by the City Room. 


6.159 There can be no doubt after the Paris attack that SMG should have sought to 
push the security perimeter out, beyond the City Room. 


Consideration of pushing out the security perimeter 


6.160 At the NAA and EAA presentation in April 2016, those in senior positions at SMG 
spoke about the need to push out the security perimeter.°°? James Allen said 
that prior to 22" May 2017 he did not seek permission to push out the security 
perimeter and prevent public access during events. His explanation for this was 
to the effect that any such request would have been refused.°® As a result of 
this belief, SMG did not approach Mansford, its landlord, or other tenants of 
the Victoria Exchange Complex to ask whether it would be possible to do so.°* 
This was a mistake by SMG. 


6.161 The evidence of Oliver Smith, on behalf of Mansford, was that if Mansford had 
been told by SMG the request was for a security reason, rather than to obtain 
any commercial advantage, legal advice would have been taken and permission 
given in a similar way to September 2017. However, he acknowledged there 
would probably have been “less urgency” and it would have taken longer to 
speak to the other tenants and agree documentation.°° 


6.162 SMG should have asked Mansford to allow for the expansion of the 
security perimeter before May 2017. Moving the security perimeter back 
from the entrance doors and beyond the City Room is a substantial threat 
mitigation measure. Had this been done, it would have made an attack in the 
City Room much less likely. It may even have deterred SA from attempting to 
carry out his attack at the Victoria Exchange Complex, although plainly he had a 
determination to carry out an attack somewhere. 
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6.163 It may be that Mansford or the other tenants would not have agreed. BTP may 
also have expressed concerns. It is impossible to say with certainty what would 
have happened. The impact of hindsight is inevitable. The fact that twenty-two 
people died and many more were injured concentrated minds on the necessity 
of changing the security arrangements in a way which might not have occurred 
before May 2017. 


6.164 Had permission been refused, SMG would have been confronted in a stark way 
with the fact that alternative improvements to security were required. This, in 
turn, should have led to a recognition of the need for a comprehensive review, 
by an appropriately qualified expert, of all of the security arrangements. 


6.165 As| have explained in Part 5, SMG should have realised the need for such expert 
input. In my view, had SMG attempted to expand the perimeter and failed, 
this is likely to have caused SMG to recognise this. If such expert input had 
been received this would have strengthened the request to Mansford for the 
perimeter to be pushed out. If Mansford had then refused this request, SMG 
could have received further expert input about how to improve the existing 
threat migration measures for the City Room, such as the use of CCTV and 
patrolling. It is likely that in at least trying to achieve this, SMG would have 
substantially improved the safety of the City Room for event-goers. 


The security perimeter pushed out 


6.166 Following the events of 22" May 2017, as | have already explained in Part 5, 
SMG instructed external security consultants to carry out a review of security 
at the Arena. The external security consultants recommendations included 
pushing the security perimeter away from the entrances to the Arena, with 
checks and searches of anyone crossing that perimeter. This included the use of 
walk-through metal detectors.°° 


6.167 In order to implement these recommendations, and in particular to close the 
City Room to the public when events were taking place, SMG needed the 
permission of Mansford as head leaseholder.*®” In September 2017, SMG sought 
this permission and were given it. Permission was granted on conditions. 

The conditions were that access still had to be given to employees working in 
the Arena Point office block by the Hunts Bank steps, anyone going to the NCP 
Car park or anyone attending the go-karting circuit which was in another part of 
the Victoria Exchange Complex. Mansford made clear that this posed a risk to its 
enterprise because It restricted the rights of other tenants and that they could 
only agree to it on a temporary basis.°°° 


6.168 In practice, this permission was given on an ongoing basis by Mansford and 
subsequently by the head leaseholder since 2018, Prestbury Investments LLP.°°? 
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Key findings 


e There was a blind spot in SMG’s CCTV system on the mezzanine. The lack of 
coverage of the Blind Spot should have been apparent to SMG prior to May 2017. 


e SMG's Arena Manager, Facilities Manager and Event Duty Manager did not know 
about the existence of the Blind Spot. 


e SMG did not have in place a system which sought actively to identify and address 
blind spots in the CCTV system. As a result, there was no robust management of 
the challenge created by gaps in the CCTV system's coverage. 


e Neither the Snowsec Head of Security on 22"? May 2017 nor the Showsec staff in 
the City Room on that day knew about the Blind Spot. 


e« SA chose to hide in the area of the Blind Spot because it was the most obvious 
place to hide in the City Room. 


e It was SMG's responsibility to identify the existence of the Blind Spot and take 
steps to mitigate the risk it posed. SMG’s failure to identify the existence of 
the Blind Spot was one of the consequences of SMG's deficient approach to 
risk assessment. 


e There were a number of straightforward ways in which SMG could have 
addressed the risk created by the Blind Spot, including additional cameras and/or 
the deployment of Showsec staff. 


e While it is not possible to determine exactly what would have happened had the 
Blind Spot been addressed, if it had been, it is likely that the Attack would have 
been disrupted, deterred or, at the least, fewer people would have been killed 
and injured. 


e SMG's general approach to the use of CCTV was inadequate. The CCTV was not 
constantly monitored during show mode and as a result the CCTV system was 
not a reliable method of identifying suspicious activity. 


Control rooms and CCTV 


6.169 SMG operated two control rooms: Whisky Control and Sierra Control. 
Whisky Control was staffed 24 hours a day, including days when events did 
not take place.°”° Days on which events did not take place were referred to 
as “dark days". Sierra Control was only staffed immediately before, during 
and immediately after events, a period referred to as “show mode".°”4 
On 22" May 2017 show mode began at 18:00.°” 
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6.170 Ondark days and event days there were two roles based in Whisky Control: 


6.171 


6.172 


6.173 


Control Room Operator and Patrol Officer. On event days, a Fire Safety Officer 
was also based in Whisky Control’” albeit not permanently.°”7 On 22" May 2017, 
these roles were occupied by Michael Edwards, Stephen Noone®” and Paul 
Johnson?” respectively. Paul Johnson spent most of the Ariana Grande concert 
in his office, which is adjacent to Whisky Control.°”” 


It was the responsibility of the Control Room Operator to watch the CCTV 
screens, listen to the radio and monitor the heating system.°’”? There were 
CCTV screens within Whisky Control onto which live images from the 

CCTV system were displayed. The cameras were spread across the Victoria 
Exchange Complex.°”? There were many more CCTV cameras than there were 
screens in Whisky Control.°®° As a result, the majority of the screens displayed 
images from 16 cameras.°*** This meant that each camera feed took up just a 
small proportion of each available screen, which were not large. There was a 
facility to display images from a single camera on a screen.°°? 


When in show mode, those in Whisky Control were expected to watch the 
CCTV monitors, among their other duties.°°* When watching the CCTV, the 
Control Room Officer looked out for suspicious behaviour.°8* When something 
suspicious was identified on the CCTV, either the Patrol Officer or the Control 
Room Operator would leave Whisky Control to investigate.°® 


The Patrol Officer, when present in Whisky Control, was available to assist the 
Control Room Operator in their duties.°8° Among the duties of the Patrol Officer 
was watching the CCTV screens.°®’ There were other tasks, such as investigating 
the breakdown of lifts, which might take the Control Room Officer away from 
Whisky Control for a short period.**® When the Control Room Officer left Whisky 
Control, they relied upon the Patrol Officer and, if present, the Fire Safety Officer 
to watch the CCTV.°°? When all three members of staff were present, more than 
one of them may watch the CCTV screens at the same time.°?° 


573 18/95/3-7 

874 18/124/15-19 

575 INQO036806/7 

876 34/38/13 

877 34/38/11-14 

578 18/81/8-17, 18/83/6-8 


$79 18/122/6-123/1 
580 18/128/13-17, 34/57/9-11 


581 18/128/13-17, 34/58/5-18 


58 18/128/18-20; 34/67/11-16 


583 18/83/18-20, 27/27/9-23, 34/41/12-43/8 


584 18/84/13-15 
585 18/86/10-87/2, 34/22/16-18 


586 18/93/2-7 

587 INQ036806/3 

588 18/109/8-110/5 

589 18/96/23-97/2, 18/120/22-121/1, 18/124/20-24 


590 18/129/1-12 


118 


6.174 


6.175 


Part 6 SMG and Showsec: terrorism threat mitigation measures 


During show mode Sierra Control was staffed. There were four people based 
in Sierra Control: the SMG Event Manager; the Showsec Head of Security; 

a representative of Emergency Training UK (ETUK) and a member of Showsec 
staff whose role was to monitor the Showsec radio. On 22 May 2017, those 
people were Miriam Stone, Thomas Rigby, Michelle Ramsbottom and Jade 
Duxbury.°** 


Sierra Control also had screens displaying images from some, but not all of the 
CCTV cameras.°* The agreement within SMG was that when in show mode, 
Sierra Control would take charge of the operation of the CCTV system.°% 

This agreement meant that if Whisky Control wished to move or zoom a camera 
during an event, permission from Sierra Control had to be obtained. 


CCTV in the City Room and the Blind Spot 


6.176 


6.177 


For some years prior to 22™ May 2017, the configuration of the CCTV cameras 
in the City Room meant that there was part of the mezzanine level in which a 

person could conceal themselves out of sight of any camera. As | indicated in 

Part 1, | have referred to this as the Blind Spot. 


Three cameras in the City Room provided views of parts of the mezzanine. 

One camera, Unit 2 Cam 1, was positioned in the area of the Fifty 

Pence staircase. This is the staircase that leads up from the NCP car park. 

This camera provided a very limited view of part of the JD Williams’ side the 
mezzanine. The focus of this camera was, though, on the top of the Fifty Pence 
staircase, not the mezzanine. Anyone viewing the images from the camera 
would naturally have their eye drawn to the top of the Fifty Pence staircase and 
landing area at the top. This was an immoveable camera with no zoom function. 
Figure 16 shows the extent to which Unit 2 Cam 1 captured the mezzanine. 
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Area of the mezzanine |- 
visible on Unit 2 Cam 1 


Figure 16: Image from Unit 2 Cam 1 showing limited view of the mezzanine’™ 


6.178 Another camera, Unit 3 Cam 14, provided a distant view of a small part of 
the mezzanine area outside the building which had formerly been occupied 
by McDonald's. This was also an immovable camera with no zoom function. 
Figure 17 show an image from Unit 3 Cam 14 with the highly limited and distant 
view of part of the mezzanine marked in the top left corner. 


594 Annotated extract from INQO35314/3 with yellow circle removed. It should be noted that the text of INQ035314/3 
incorrectly identifies this image as having been taken from Unit 2 Cam 2 
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=| Area of the mezzanine 
| visible on Unit 3 Cam 14 [RS 
= 4 i ui: ’ 
' 


Figure 17: Image from Unit 3 Cam 14 showing limited view of the mezzanine’? 


6.179 The camera capable of providing the best view of the mezzanine level, Unit 2 
Cam 2, was able to tilt, pan and zoom.°*”® Its extent and limitations were covered 
in detail by the evidence of Michael Edwards°”’ and Michael Cowley.°”? | was also 
given considerable assistance in relation to this camera by Detective Sergeant 
Michael Russell of GMP who co-wrote the CCTV policy for GMP’s investigation 
into the Attack. 


6.180 Unit 2 Cam 2 provided good coverage of significant parts of the City Room. 
It provided a particularly good view, from an elevated position, of the Arena 
entrance/exit doors to the City Room?°*? and the box office. A large number 
of the images from Unit 2 Cam 2 the Inquiry considered from 22°¢ May 2017 
showed these areas. There were images from the night when it is clear that the 
operator had moved it for periods of time so that it captured the full width of 
the mezzanine level that it covered. 


595 Annotated extract from INQO035314/15 with yellow and green circles removed. 
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6.181 However, even when Unit 2 Cam 2 was focused on the mezzanine level, there 
remained parts of the mezzanine which were not visible. The principal cause 
of this is the raised area above the Grey Doors which blocks the sightline from 
Unit 2 Cam 2 to the area immediately behind this raised area. 


6.182 Figure 18 shows the view captured by Unit 2 Cam 2 when directed towards the 
mezzanine. Unit 2 Cam 2 was also capable of panning further to the right than 
is shown in this image to capture the area of the mezzanine outside McDonald's 
nearest the exit from the City Room onto the overbridge. 


— Former location 
pn | =o eae of McDonald's 
=m Raised area above 
the Grey Doors 


Figure 18: Image from Unit 2 Cam 2 showing the extent of the view of the mezzanine®” 


6.183 By sitting, Kneeling or crouching, a person could completely conceal 
themselves from the sight of Unit 2 Cam 2.°° The area was large enough 
to accommodate and conceal a number of people. It was large enough to 
conceal a person with a large backpack. Figure 19 shows the positioning of the 
relevant cameras and the approximate area of the Blind Spot. Figures 20 and 
21 depict the approximate area of the Blind Spot, viewed from the JD Williams’ 
side and the McDonald's side of the mezzanine respectively. In each case, the 
approximate area of the Blind Spot is shaded in yellow. 


600 Annotated image extracted from INQ035314/8 with yellow circle removed. 
601 26/188/12-189/14 
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; ¢ | nit 3 Cam 14 2 


RECEPTION 


Unit 2 Cam 2 


Former location of 
McDonald's 


Figure 19: Relevant City Room cameras and the Blind Spot (shaded in yellow)®” 


602 Annotated extract of INQ035294/1 
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Unit 2 Cam 2 ——— \\1 Lee Raised area above the 


Grey Doors and stairs to 
platform overbridge 


Former location | 
of McDonald's : 


Figure 20: The Blind Spot (shaded in yellow): view from McDonald's side&™ 


603 Annotated extract from INQO31767/6 
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Raised area above the 
Grey Doors and stairs to 
platform overbridge 


Figure 21: The Blind Spot (shaded in yellow): view from JD Williams side&™ 


6.184 


6.185 


It was in this area that SA chose to conceal himself during a significant 
proportion of the period after 20:30. Across both visits to the City Room he 
spent in excess of an hour and a quarter on the mezzanine before he detonated 
his bomb.® | do not consider he did so purely by chance. Setting aside the 
CCTV system, this was the best hiding place within the City Room. In the words 
of Colonel Latham: “it was a good place to hide".©° This is not a conclusion 

| reach with the benefit of hindsight, but from simply considering the layout 

of the City Room as it was on 22™4 May 2017. | find that this must also have 

been the conclusion SA reached as a result of his hostile reconnaissance of the 
City Room. 


The fact that this obvious place of concealment was not covered by a camera 
was, therefore, a significant gap in the CCTV system's coverage. The problem 
this gap created was compounded by the fact that the only camera which 
gave any coverage on either side of the Blind Spot was not permanently 
focused on that area. As a result, unless Unit 2 Cam 2 was, by chance, pointed 
at the mezzanine, once a person had ascended either set of stairs up to the 
mezzanine, anyone viewing the cameras would have no idea whether that 
person had gone to JD Williams or hidden themselves. It is a striking feature 
of the evidence that there are no images from the CCTV which capture SA on 


604 Annotated extract from INQ031767/4 
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6.186 


6.187 


the mezzanine on 22™ May 2017.” This is despite the fact he spent in excess 
of an hour and a quarter in that area. There are two reasons for this. The first is 
that when SA was not in the Blind Spot, such as just before he descended the 
McDonald's side staircase, Unit 2 Cam 2 was not pointed at the mezzanine. 
The second is because he was concealed in the Blind Spot on every one 

of the limited number of occasions®°? when Unit 2 Cam 2 was pointed at 

the mezzanine. 


The Inquiry heard from a number of those who viewed the CCTV screens as 
part of their job. They were each asked whether they knew about the existence 
of the Blind Spot. Only one witness, Michael Edwards, the Control Room 
Operator in Whisky Control on 224 May 2017, said he was aware of the Blind 
Spot. Michael Edwards stated he had known about it since he started working 
at SMG, 14 years prior to the Attack.®° He stated he thought everyone knew 
about the blind spots in the CCTV system.® He stated that anyone who had 
worked in Whisky or Sierra Control would have known about the Blind Spot.® 
While Michael Edwards might have believed this, having heard evidence from 

a number of key people at both SMG and Showsec, it is my view that he was 
mistaken as to how widely known the existence of the Blind Spot was. 


The evidence was that James Allen,* Michael Cowley®* and Miriam Stone®* 
did not Know about it. Consequently, Miriam Stone did not make any allowance 
for the Blind Spot when planning for events or in discussion with Showsec. 
James Allen accepted he should have known about it. He stated he did not 
learn of it until he heard about it through this Inquiry.®” James Allen stated 
that SMG operated a system in which, if a blind spot was identified, a person 
would be deployed to cover it on the ground.°®’® In reality, there was no system 
employed by SMG which sought actively to identify and address blind spots 

in the CCTV system.°® As a result, | find that this was a theoretical aspiration, 
rather than robust management of the challenge created by gaps in the CCTV 
system's Coverage. 
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Paul Johnson, the Fire Safety Officer on 22"7 May 2017 was not sure whether 
or not he knew about the Blind Spot in 2017.*° He had also held the role of 
Security Supervisor since 2005. He had never discussed the Blind Spot with 
anyone in that capacity.°4 


So far as Showsec was concerned, neither Thomas Bailey nor Thomas Rigby, 
who both acted as Head of Security at events at the Arena, knew about the 
Blind Spot.®? As a result, no account was taken of it by them when planning the 
deployment of Showsec staff at events and the route taken by patrols. On the 
ground, the Showsec City Room senior supervisor, David Middleton, did not 
know about it despite having worked at the Arena for 21 years.°*? The same 

was true of all of the other Showsec staff who worked in the City Room on 

22™ May 2017.54 


It was only in the summer of 2020 that the Blind Spot was completely 
eliminated by SMG making alterations to its CCTV system.®° 


Mitigating the Blind Spot 


6.191 


6.192 


6.193 


As owner and principal operator of the CCTV system, it was SMG’s responsibility 
to identify the existence of the Blind Spot. It should have done so as part of the 
proper conduct of its risk assessment process. Had SMG identified the Blind 
Spot as part of a suitable and sufficient risk assessment, consideration would 
have been given to what steps were required to mitigate it. This, in turn, would 
have led to the consideration of adding cameras or agreeing a deployment 

by Showsec of its staff to mitigate the Blind Spot during events. This could 

have included regular and frequent patrols to the area out of the view of the 
cameras®° or the positioning of a static member of Showsec staff who had a 
clear view of the area the camera could not see. 


Had SMG added an additional camera, this would have increased the possibility 
that SA would have been detected in the City Room before he detonated his 
bomb. However, the way in which the CCTV system was used by SMG in May 
2017 required substantial improvement before this was likely to have made a 
difference. | will deal with this below. 


The alternative way in which the Blind Spot should have been addressed 

was through the use of Showsec staff. Had this been identified as a control 
measure, as James Allen stated was his intended approach, it may have had 
one of a number of effects on what occurred on 227 May 2017. The presence 
of Showsec staff on the mezzanine may have deterred SA altogether. However, 
| consider this to be unlikely. It may have led to the Attack being disrupted 
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6.194 


by causing him to wait elsewhere within the Victoria Exchange Complex. 

This would have reduced his ability to time his Attack as he wished. | think this 
is the probable effect of SA realising that he would be detected if he hid for a 
lengthy period in the area of the Blind Spot. Had SA not been disrupted in this 
way, it is likely Sierra Control may have been notified, which may have led to SA 
being spoken to. What would have then occurred Is heavily dependent upon 
the timing of this intervention. It is not possible to say that any one of these 
outcomes was more likely than not to have occurred. 


It is not possible for me to determine exactly what would have happened had 
the Blind Spot been addressed through patrolling and/or proper monitoring 

of an adequate CCTV system. | am able to conclude that if it had been, it is 
likely that the Attack would have been disrupted, deterred or, at the least, fewer 
people would have been killed and injured. 


Deficiencies in SMG's approach to CCTV 


6.195 


6.196 


6.197 


CCTV is an essential counter-terrorism measure for any organisation in SMG's 
position: that of an operator of a large public entertainment venue. The sheer 
number of people who could attend an event, coupled with the mixing that 
would inevitably take place around the Arena with members of the public 
passing through, meant that having a comprehensive overview of all the 
important areas around the Arena was a necessity. The complexity of keeping 
people safe in this environment required SMG to maximise the prospect of 
identifying suspicious activity as soon as possible. 


The NaCTSO guidance “for Stadia and Arenas" at the time stated that CCTV 
could be constantly monitored or the recordings regularly checked.®’ As this 
document states, it is “not site specific and all stadia and arenas are different’ °° 
For activities as well attended and complex as those which took place at the 
Arena, real time monitoring was necessary, if there was to be any prospect of 
using It as a counter-terrorism measure during an event. 


The importance of effective CCTV monitoring was underlined by Michael 
Edwards’ evidence. He stated that had he noticed the full extent of SA’s 
movements and appearance on 22" May 2017, he would have regarded them as 
being suspicious.®”? | accept this evidence. Paul Johnson gave evidence, which | 
also accept, that if someone in Whisky Control had noticed that SA had gone on 
the mezzanine and remained there for some time this would have been called 
through to Sierra Control.®° SA was not noticed by those in Whisky Control as 
being suspicious® and this was not just because of the Blind Spot. 
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6.198 There was a general problem with SMG's CCTV system and its approach to it. 


During show mode, those in Sierra Control, who assumed responsibility for 
control of the CCTV system, did not monitor it constantly.°%* What | mean by 
monitor in this context is a person constantly reviewing images in real time, 
proactively, with a view to identifying suspicious activity. 


6.199 The SMG Event Manager and Showsec Head of Security in Sierra Control 


used the CCTV for crowd management.®* If a specific request came in from a 
member of staff on the ground, then focus would be given to that by those in 
Sierra Control.°% 


6.200 There was an expectation that those in Whisky Control would monitor 


the CCTV.° However, there were five problems with this as a reliable method of 
identifying suspicious activity. 


6.201 First, the arrangements that SMG had in place did not guarantee that 


there would be constant monitoring before, during and after events. They 
should have.°®*° All three people in Whisky Control had duties beyond the 

CCTV. The Control Room Operator did not exclusively devote his attention to 
watching the CCTV.°” Michael Edwards stated that on 22" May 2017 his other 
tasks had taken him away from watching the CCTV screens in the course of 

the evening.®8 This included being out of Whisky Control for a few minutes 
during the period SA was on the mezzanine in the hour before the detonation.*°? 
There is no criticism of Michael Edwards for having done so: he was undertaking 
his duties as he had been instructed to. 


6.202 | accept that those in Whisky Control who gave evidence to this Inquiry worked 


collaboratively with each other,®° but | find that it was not regarded as essential 
by them that someone was viewing the CCTV monitors at all times.®! | do not 
accept that there was always someone monitoring the CCTV during events.° 
From the totality of the evidence | heard, | did not accept that SMG’s system was 
sufficiently robust to guarantee continual monitoring. It needed to be. 


6.203 Asto the number of people who should have been monitoring at any one time, 


it is beyond the scope of the Inquiry to conduct an exhaustive examination of 
the extent of the CCTV system. | did not receive enough evidence to reach 
any firm conclusion as to the minimum number of people who should have 
been devoting themselves exclusively to monitoring the CCTV during an 


34/144/1-7 

30/142/17-21, 34/143/19-23, 33/34/15-24 
30/143/19-23 

34/144/8-11, 30/150/23-24, 33/35/6-8 
41/206/18-207/13 

18/87/3-15 

18/101/10-17 

18/111/15-112/7 

18/124/6-14, 18/129/1-12 
18/120/22-121/1, 18/20/2-22/22 


34/23/17-19, 34/43/9-14 


129 


Manchester Arena Inquiry Volume 1: Security for the Arena 


6.204 


event. However, my impression from the substantial body of evidence | heard 
about CCTV was that just one person monitoring it may not be sufficient.°* 

| make clear, however, that in saying this | am making no finding so far as the 
minimum number of people who should have been monitoring the CCTV on 
22™ May 2017. | conclude that it should have been at least one and that this was 
not the case during the Ariana Grande concert because of the number of things 
that were occurring in Whisky Control. 


Second, the way the system itself was set up meant that almost all of the images 
from each camera were small. This was also true in Sierra Control.°* This 

meant that identifying the subtle cues that might mark activity as suspicious was 
harder to detect. | agree with the evidence of Paul Johnson, when he stated 
that identifying SA in these circumstances would not be easy.®° Paul Johnson, 
who was in a very good position to know, stated that "the images are too small 
to pick out one person" when the images were not enlarged.®° While it would 
have been impractical to have all of the images of a substantial size, having a 
number of substantial sized images of key areas in Whisky Control would have 
improved the prospect of suspicious activity being detected. 


6.205 Third, the agreement between Sierra and Whisky Control that Sierra took 


over the operation of the CCTV system during show mode’ could cause 
problems. Sierra Control used the CCTV system reactively and did not monitor 
it continuously.**® Despite this, Sierra Control was primarily responsible for 
which cameras were moved. Whisky Control could ask for control back®? 
and, | accept, did so on occasions.®° However, this arrangement created 
difficulties in two ways. Michael Edwards mistakenly believed that Sierra 
Control was watching the CCTV throughout an event.®" Further, Sierra 
Control having primary control over the CCTV system would not have the 
effect of encouraging Whisky Control to monitor proactively the feeds ona 
continuous basis. 


6.206 Fourth, at the time when large groups of people were moving through the 


venue, such as at egress, the focus of those watching the CCTV was on the 
event-goers leaving the Arena, rather than looking out for suspicious activity.°°? 
Unit 2 Cam 2's superior view of ingress and egress®*s meant that it was directed 
away from the mezzanine at those times. This had the effect that the entire 
mezzanine was not monitored by CCTV at the time when substantial effort 
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should have been devoted towards looking out for threats. This too was a 
product of the failure of the risk assessment process. This should have identified 
that particularly careful monitoring of all areas of risk was required at times and 
in places of high crowd density. This was not SMG’s approach and it should 
have been. 


Given the importance of monitoring, if it was to be done by Whisky Control 
during an event, the relationship and arrangements between the two control 
rooms should have been better than they were. 


Fifth, | regard the approach to the training of those who were responsible 
for continuous CCTV monitoring to be deficient for the reasons | have set 
out above. 


| consider that SMG's approach to CCTV was inadequate. This inadequacy in the 
approach to CCTV, including the lack of coverage of the Blind Spot, should have 
been apparent to SMG prior to May 2017. 
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Key findings 


e There was confusion between SMG and Showsec as to whether, during events 
Showsec was required to undertake security patrols/pre-egress checks of the 
entirety of the City Room which included a counter-terrorism element. SMG 
thought that Showsec was undertaking a patrol of this nature; Showsec did not 
think it was part of its role to do this. 


« Asaresult of the confusion, Showsec did not generally undertake security patrols 
of the entirety of the City Room including the mezzanine. Showsec should have 
made sure their staff properly checked the mezzanine during pre-egress checks. 


e Primary responsibility for the confusion lies with Showsec. However, SMG should 
have checked whether Showsec was doing what SMG expected it to do. 


SMG 


6.210 A key element of the security arrangements at the Arena was regular patrols. 
There was confusion between SMG and Showsec about how these patrols were 
conducted during events, and in particular about what the pre-egress checks In 
the City Room entailed. This led to a missed opportunity to identify SA as | set 
out in Part 1. 


6.211 The facilities management agreement required SMG to undertake Deister 
Patrols®° 24 hours a day, 7 days a week.®°° The patrols looked for obstructions, 
spillages and leakages, as well as ensuring doors were locked if appropriate. 
One purpose of these patrols was counter-terrorism, specifically looking out 
for “suspicious activities (anything out of the ordinary or any person found 
loitering)".®°’ At least eight patrols were to be done in any 24-hour period.°® 
The Deister Patrol route covered the City Room mezzanine and included the 
location where SA hid on 22™9 May 2017.°° 


6.212 Onevent days, the SMG facilities management team had many more tasks 
to do.°° As a result, they did not carry out Deister patrols during the event itself, 
when Showsec staff were present. 
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Showsec 


6.213 


6.214 


6.215 


6.216 


6.217 


Showsec’'s Counter Terrorism Awareness 2017 document, as set out above, 
stated that: 


“The building operations include various different patrols to ensure it is 
constantly being checked. On a Non-event day or out of event hours the 
patrols are undertaken by the SMG Whisky control room staff. These checks 
span the whole of the venue and cover all key/vulnerable areas such as 
entrances and/or lifts. 


During events these patrols are undertaken by Showsec Security staff. 
The Access Control/IRT Teams are redeployed to patrol around the venue 
and ensure it is secure and for public safety..."°° 


Some of the SMG facilities management team assumed that Showsec carried 
out similar patrols during events, albeit not using the Deister equipment, but 
it seems there was never an explicit conversation about exactly what this 
would entail.°° 


Although SMG knew that the primary focus of Showsec on event days was 
on public access and egress, SMG thought that the pre-egress checks by 
Showsec would have included the City Room mezzanine.°* SMG produced 
a pre-egress check sheet for Showsec staff to use, and this specified that the 
check needed to cover the “entire City Room area including McDonalds and 
JJ Williams Entrance”.°°° 


Michael Cowley, SMG's Director of Facilities Services in May 2017, thought 

this was unambiguous and simply meant “wall-to-wall in all directions, the 
entirety of the City Room.". He expected the Showsec staff to go up one set of 
stairs, along the mezzanine, and down the other stairs as part of the check.®° 
He also understood Showsec’s patrols to be discharging a counter-terrorism 
function in the same way as the Deister Patrols.°°” Miriam Stone had the same 
understanding and said, “it never occurred to me” that Showsec could have 
thought the pre-egress check meant something different.°°° 


The pre-egress check of the City Room carried out by Jordan Beak on 

22™ May 2017 consisted of walking through the City Room with a brief glance 
towards the McDonald's side stairs up to the mezzanine to see if they were 
clear. Jordan Beak did not accept that this was insufficient, or that it was 
incompatible with the pre-egress check sheet wording. His interpretation of 
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6.218 


6.219 


the phrase "McDonalds and JJ Williams Entrance" was that it referred to the 
stairs leading on to the mezzanine. He did not consider the mezzanine area to 
be part of the City Room.®®? He thought his responsibility was to see if there 
was anyone sitting on the stairs and, if so, to ask them to move. He said he was 
able to fulfil that role by looking across from the other side of the City Room.°”° 
He did not think it was his job to look for anyone suspicious on the mezzanine. 
Even when it was pointed out to him that he had gone onto the mezzanine 
earlier that evening®” he maintained that it “wasn't part of our jurisdiction or our 
check area" °” 


There was one witness, Jonathan Lavery who was a Showsec member of staff, 
who said he routinely went onto the mezzanine, including when conducting 
pre-egress checks.°”* Kyle Lawler said he had seen Showsec staff going on 

the mezzanine. He thought they were checking it.°’ There was evidence of 
Showsec dealing with a suspicious package on the mezzanine at a Disney on Ice 
concert on 14" October 2016.°” 


However, Jordan Beak’s interpretation of the extent of the pre-egress check 
was more common. Thomas Bailey acknowledged that the natural meaning 
of the words on the pre-egress check sheet included the mezzanine, but said, 
“our understanding of it was the bottom of the steps."°’”° David Middleton also 
accepted that the literal meaning of the pre-egress check sheet included the 
mezzanine,°” but like Jordan Beak he had understood in practice that the 
pre-egress check applied only to the stairs, and that the mezzanine area was 
not Showsec's responsibility.°’® Daniel Perry thought that pre-egress checks 
involved looking at the stairs, but not the mezzanine level itself.°”? In contrast 
to Jordan Beak, David Middleton®®° and Daniel Perry®*? both thought that part 
of the purpose of the pre-egress check was to look for any kind of suspicious 
behaviour, but only within the main City Room space, not the mezzanine. 
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The City Room pre-egress check sheet had been reviewed, along with all 

the others, in early 2015 by Thomas Bailey and Lucy Hunt, who was an Event 
Manager at SMG between 2010 and 2016.°* At no point in their discussion was 
the difference in understanding about whether the pre-egress check included 
the mezzanine clarified. As Thomas Bailey put it: 


“| wouldn't have brought it up with Lucy because | thought we were just 
going to do what we usually do. She didn't bring it up with me because 
she thought we went up on to that mezzanine. So it was never discussed 
because we both must have had an understanding that each of us thought 
we were doing the same thing. “6°? 


The Security Experts were of the view that the check sheet was clearly 
written.°** They also thought that SMG had a responsibility to ensure that the 
security work they expected to be done by Showsec, including the pre-egress 
checks, was in fact being carried out. They commented that they would not 
have expected SMG to be ignorant of the fact that for a considerable period of 
time before 22"? May 2017, Showsec staff were simply looking at the bottom of 
the stairs in the City Room rather than patrolling the mezzanine.°°° 


It seems extraordinary that two large and commercially successful companies 
had such a fundamental misunderstanding of what they had agreed. Showsec 
characterised what happened as a “breakdown in communication between 
the two companies".®*’ SMG say that any breakdown of communication was 
“internal to Showsec and entirely of its own making”".°°8 


On the one hand, the obligation under the facilities management agreement 
lay with SMG to provide regular patrols at all times. While it was open to them 
to agree that Snhowsec should conduct those patrols during events, they were 
under a duty to ensure these were being carried out and should have checked. 
Such a check would have been straightforward and could have been done 

by simply viewing the CCTV. The closure of the McDonald's restaurant at 

the end of January 2017,°°° which had a significant impact on how busy the 
mezzanine area was during events, also presented an opportunity to review the 
pre-egress checks and confirm they were being done in an adequate manner. 
This opportunity was not taken.°° 


On the other hand, the primary responsibility for the confusion about the 
pre-egress checks lies with Showsec. The wording of the check sheet 
was Clear. It was reasonable for SMG to think that the pre-egress checks did 
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include the mezzanine. It is difficult to see how the check sheet could properly 
be interpreted by Showsec staff as simply looking up the two sets of stairs 
leading to McDonald's and JD Williams from the bottom and clearing people 
away from the stairs if necessary. Snowsec should have made sure their staff 
properly checked the mezzanine level and should have made sure that Jordan 
Beak did so on 22"9 May 2017. 


6.225 By agreeing to complete the pre-egress check sheet, Showsec was under an 
obligation to carry out a security patrol of the mezzanine. | regard the failure 
to do so as being Showsec’s, rather than that of its employees on the ground. 
This security patrol included being vigilant for the threat from terrorism. 


6.226 In Part 1, | have addressed what | consider is likely to have occurred had a 
security patrol taken place at the time of the pre-egress check. 
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Key findings 


BTP was responsible for the day-to-day policing of the City Room. 


When planning the deployment of officers to police events at the Arena, 
BTP failed to give adequate consideration to the threat from terrorism. 


BTP failed to communicate and coordinate adequately with SMG and Showsec 
immediately before, during and after events. 


BTP failed to give adequate consideration to the threat from terrorism when 
assessing the risks to the public when events were taking place. No written 
risk assessment was conducted by BTP for the Ariana Grande concert or 
events generally. BTP should have prepared a written risk assessment which 
expressly considered the threat from terrorism for every event attended by a 
substantial number of people. 


Five BTP officers were deployed to police the Ariana Grande concert. Only four 
BTP officers were present in the Victoria Exchange Complex during the concert 
up to the point of the explosion. 


Contrary to their briefing, no BTP officer was present in the City Room in the 
30 minutes prior to the end of the concert. 


Contrary to their briefing, the BTP officers who attended took breaks substantially 
and unjustifiably in excess of what they were permitted to. As a result, there were 
no BTP officers in the public areas of the Victoria Exchange Complex when SA 
walked to the City Room for the final time. 


There was a lack of clear leadership and supervision from any police officer 
present within the Victoria Exchange Complex. This was a significant contributory 
factor to the failure by BTP to ensure a presence in the City Room in accordance 
with the officers’ briefing. 


The BTP officers deployed to police the Ariana Grande concert were 
adequately briefed. 


The BTP officers deployed to police the Ariana Grande concert had received 
adequate counter-terrorism training. 


BTP officers failed to follow their briefing because they failed to appreciate the 
need, when on duty, to be alert to the possibility of a terrorist attack. 


BTP failed to instil in the officers deployed to the Ariana Grande concert the 
need, when on duty, to be alert to the possibility of a terrorist attack. 
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7A Both GMP and BITP officers had the jurisdiction to act with the powers of a 
police constable within the Victoria Exchange Complex. The issue of which of 
these two police services should take lead in relation to any particular policing 
activity is known as primacy. 


7.2 In Volume 1 my focus is on primacy for day-to-day policing. By day-to-day 
policing | mean the planning and provision of police officers to be present 
within Victoria Exchange Complex. The function of those officers includes 
the deterrence of, through visible presence, and detection of terrorist activity. 
| do not include the CTSA scheme within my use of the phrase day-to-day 
policing. Nor do | include within day-to-day policing, the response of either 
police service to a major incident at the Arena or, in particular, the response to a 
terrorist attack. 


7.3 | am satisfied that BTP had primacy for the day-to-day policing of the City 
Room and surrounding areas within the Arena complex on 22" May 2017.°% 
BTP was responsible from a day-to-day policing perspective for keeping 
members of the public safe in the City Room. Both GMP and BTP agree this was 
the case.®? 
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Operational plan for deployment to events 


7.4 


7.5 


7.6 


BTP Inspector Michelle Wedderburn was the Police Inspector responsible for 
overseeing the BTP policing of railway stations in parts of Greater Manchester, 
including Manchester Victoria, for the period March 2009 to October 2016 and 
April 2017 to September 2017. In the intervening period she was seconded to the 
Operations Department.® As part of her responsibility for Manchester Victoria, 
Inspector Wedderburn attended the bi-annual multi-agency meetings at which 
forthcoming events at the Arena were discussed.°4 Inspector Wedderburn also 
received information from SMG relating to events. The focus of that information 
was what might disrupt particular events, such as a risk of disorder or whether 
an event was likely to be the target of thieves.®* It was Inspector Wedderburn's 
responsibility to ensure that sufficient officers were deployed to police events at 
the Arena in May 2017.°°° 


Inspector Wedderburn gave evidence about a document entitled 

“Tactical Report — Phones 4U Arena” (the 2014 Tactical Report).£°? Phones 4U 
Arena was a previous name of the Arena. This document is undated, but was 
created by PC Peter Wood in approximately June 2014.°8 As is plain from the 
introductory paragraph, the document provides BTP planners and operational 
commanders with an overview of policing at the Arena. It states that it should be 
“treated as advice".©*? It refers to the “Current threat level" as being one of three 
criteria relevant to the “policing numbers and style". In June 2014, the terrorist 
threat level was “Substantial”, meaning an attack is likely, and a level lower than 
it was in May 2017. 


There is no evidence that the 2014 Tactical Report had been withdrawn prior to 
it being updated in September 2017.7°° However, Inspector Wedderburn was not 
aware of the 2014 Tactical Report before 22" May 2017” and the update was 
as a result of its existence having been identified after the Attack.”°* | consider 
this to be a matter for concern as it means that Inspector Wedderburn was 
planning deployments to events at the Arena without reference to this or any 
similar document. 
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7.7 


7.8 


7.9 


7.10 


7.11 


7.12 


Inspector Wedderburn agreed that the 2014 Tactical Report contained helpful 
information and was the product of careful thought. However, she stressed 
that the author did not Know the Arena and had never worked there.’”°5 For that 
reason, she considered that the content was of less use to someone in her 
position, who did have such personal Knowledge. 


The 2014 Tactical Report recommends that for "high" ticket-sale events 

one sergeant, four constables and two PCSOs should be deployed to the 
Victoria Exchange Complex. The Ariana Grande concert fitted the description 
of a “high" ticket-sale event,’ but Inspector Wedderburn stated that the 
refurbishment in 2014 meant that in May 2017 fewer officers were required 
than recommended.’ 


The refurbishment of the Victoria Exchange Complex required careful 
reconsideration of policing numbers and a wholesale review of the 2014 
Tactical Report.’°° This should have taken place before the reopening in 2015. 
This did not happen because Inspector Wedderburn did not know about it. 
Inspector Wedderburn should have known about the 2014 Tactical Report.”°” 


Those responsible for briefing the officers who were deployed should have been 
aware of and worked to a written plan. Sergeant Gareth Wilson, who conducted 
the briefing on 22"? May 2017, did not know about the 2014 Tactical Report.’°8 
Additionally, if the existing plan for policing the Arena was deficient, as Inspector 
Wedderburn asserted it was by reason of the author's lack of direct experience 
of working at the Victoria Exchange Complex, that too should have been taken 
into account and corrected long before the Attack. 


Had Inspector Wedderburn identified the importance of working to a plan, 
either the 2014 Tactical Report would have come to her attention and been 
considered by her or, alternatively, a fresh plan would have been created. 


The effect of Inspector Wedderburn not knowing about the 2014 Tactical 
Report was that officers were not being deployed to police events on the basis 
of any document or plan that specifically considered the particular risks to 
people attending events at, and the demands of, the Arena. Those risks included 
the threat from terrorism to event-goers. Since the Attack, BTP has created a 
generic security plan for events at the Arena.”°? The importance of working to 
such a document should have been obvious to BTP before the Attack. 
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7.13 Inspector Wedderburn and a colleague attended Exercise Sherman in July 2016, 
the multi-agency exercise which involved a terrorist attack scenario in the 
City Room.”° This, as Inspector Wedderburn accepted, should have resulted in 
a review by BTP of the policing of events at the Arena.” There was no review. 
Such a review was likely to have highlighted the fact that events, at that time, 
were not being policed in accordance with any written plan. 


7.14 ~— ‘The discipline of creating, updating and working to a written plan is likely to 
have uncovered further deficiencies in BTP’s approach to policing events at 
the Arena. It would have provided an opportunity to reflect upon and develop 
arrangements for collaborative working with SMG and Showsec before, during 
and after events. This would have strengthened the relationship between the 
three organisations and ensured that there was effective communication, 
coordination and co-operation. 


Communication, coordination and co-operation 


7.15 SMG hosted the bi-annual meetings and so there was regular formal contact 
with BTP in that setting. | accept Miriam Stone and Paul Johnson's evidence 
that they both had a good relationship with those they dealt with at BTP.” 
Showsec attended these meetings as well. 


7.16 Showsec recognised the importance of liaison with BTP. Showsec’s Operational 
Plan for the Arena had a section which addressed liaison with the police.” 
It sets out the need for the sharing and division of responsibility “where police 
are deployed to an event". The document asserts that “over the past years 
Showsec have worked closely with Greater Manchester Police (GMP) and the 
British Transport Police (BTP)." 


7.17 On 20" May 2017 Showsec called upon BTP to assist with a suspicious person.” 
The evidence demonstrated a good working relationship between the two 
organisations on that occasion. 


7.18 The evidence revealed that Showsec did not know the number of officers BTP 
deployed for events.” Nor was there any evidence of a formal arrangement 
between Showsec and BTP in relation to their respective plans. The discussion 
of individual events during the bi-annual meetings was at a high level. It tended 
to focus on events where problems might be caused by attendees, such as 
boxing matches. Specific deployments at events which were not identified as 
being likely to result in potential disorder from event-goers was not discussed in 
any detail. 
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7.19 None of the officers deployed to police the Ariana Grande concert were aware 
of any formal arrangement between BTP and Showsec that required them 
to liaise in a systematic and pre-planned way, immediately prior to, during 
and after events.” As a result, whether there was any contact at all between 
BTP and Showsec during the period of an event was left to the discretion of 
individual officers. 


7.20 There was no robust system implemented by BTP to inform Showsec or 
SMG where, when and in what numbers officers would be deployed during 
an event. Nor did BTP know what Showsec’'s plan was in terms of the frequency, 
ambit and timing of Showsec patrols. There was a substantial failure of 
coordination by BTP. 


7.21 Adequate communication, coordination and co-operation by BTP with SMG and 
Showsec would have resulted in additional focus on the importance of a BTP 
presence in the City Room on 22™ May 2017. This was likely to have resulted in a 
BTP officer being present in the City Room during egress. Such an officer would 
have been on hand at the point when Christopher Wild formed his concerns. 
Greater coordination would have materially increased the likelinood that the 
BTP officer present would have been spoken to by Christopher Wild or become 
involved, if those concerns had been raised with Mohammed Agha. | have 
addressed above the potential causative consequences of this in Part 1. | have 
also considered SMG and Showsec's responsibility to coordinate, communicate 
and co-operate with BTP in Part 6. 


Risk assessment 


7.22 A further opportunity to take proper account of the threat from terrorism 
was the carrying out of suitable and sufficient risk assessments on an 
event-by-event basis. No written risk assessment was conducted by BTP for 
the Ariana Grande concert or events generally.”” It was not the culture of BTP 
at that time to prepare such documents.”° A written risk assessment, which 
expressly considered the threat from terrorism for every event attended by 
a substantial number of people, should have been prepared. This is now 
the case.” 


7.23. Inspector Wedderburn stated that she undertook an assessment of events using 
the National Decision-Making Model’°. She said that she did not communicate 
the outcome of this process to anyone, although she did have a discussion 
about resourcing with the rostering sergeant.’*4 Having heard Inspector 
Wedderburn’s evidence about the process she undertook, it is clear to me 
that the focus of her assessment was on the audience numbers and profile. 
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Her approach was over-dependent on the existence of intelligence of a specific 
threat’? and her general expectation that any officer who was deployed would 
have the threat from terrorism in their minds. Her approach did not adequately 
take into account the threat from terrorism. Had she adopted a more formal 
process in writing, which she shared with others, these shortcomings would 
have been much more likely to have been detected and corrected. 


7.244 ACC O'Callaghan stated within BTP as an organisation there was no focus 
on planning a policing response to a PBIED.’*° Consequently, | find that this 
particular risk was not adequately considered by Inspector Wedderburn when 
she was planning deployments to events. Of particular concern to me was the 
evidence that, when the threat from terrorism was considered by BTP, there was 
insufficient consideration of the nature of the terrorist attacks in Europe which 
preceded 22"4 May 2017.” 


7.25 Having heard from ACC O'Callaghan,’”*° | am satisfied that the failure to have 
proper regard for the nature and extent of the threat from terrorism when 
policing events at the Arena prior to May 2017 was not an issue confined to 
Inspector Wedderburn, but it existed at a higher level within BTP. 
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7.26 Five officers were deployed to police the Ariana Grande concert: PC Corke, PC 
Bullough, PCSO Renshaw, PCSO Morrey and PCSO Brown. PCSO Brown was 
still undergoing tutoring under PCSO Morrey on 22" May 201777 and so he was 
expected to remain with PCSO Morrey.’2’ 


7.27. The circumstances of the deployment were as follows. In 2017 Sergeant 
Wilson was an officer with 22 years’ service.’78 At 14:10779 on 22"4 May 2017, 
he delivered a verbal briefing which included the deployment to the Victoria 
Exchange Complex. In the course of the briefing, Sergeant Wilson mentioned 
counter-terrorism.’°° PSCO Renshaw attended this briefing, having come on 
duty at 14:00.73 PC Corke, PC Bullough, PCSO Morrey and PCSO Brown did not 
attend the verbal briefing as they did not come on duty until 15:00.7°? 


7.28 In addition to the verbal briefing, in an email sent at 14:41 on 224 May 2017, 
Sergeant Wilson provided a short, written briefing to all of those who were 
allocated to the concert.”** The email was addressed directly to PC Corke, PC 
Bullough, PCSO Renshaw, PCSO Morrey and PCSO Brown. It informed these 
officers that they “are down to assist the concert tonight". It stated that the 
officers are "deployed for the in and the out." It instructed the officers to deploy 
to three areas, one of which was “patrolling the city rooms". It stated that breaks 
should “be staggered between 1930-2100 so we have someone at Victoria". 
Attached to the email was the event rider which included information about the 
audience demographic. Neither the email nor the event rider referred to the 
threat from terrorism. 


7.29 PC Corke and PC Bullough both recalled having seen the written briefing.’ 
PCSO Renshaw did not have a mobile phone with him and so did not see it,” 
but he had received the verbal briefing. PCSO Morrey had no recollection of 
whether he saw the email.”° PCSO Brown thought he may have seen it as it was 
his practice to check his emails.’*” 
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7.30 Sergeant Wilson stated that by “the in and the out” he meant ingress to and 
egress from the concert.’”*8 He stated that his expectation was that there would 
be a BTP patrol looking out for suspicious activity or suspicious people in the 
City Room about 30 minutes before people started to walk out.’%? This time 
range accorded with PC Corke’s understanding of the meaning of egress.’4° 
It also accords with common sense. 


7.31 Sergeant Wilson's meaning was clear in the email. The email directed that 
there should have been a policing presence in the Victoria Exchange Complex 
throughout the period of the deployment. The email directed that at least 
one officer should have been in the City Room from approximately 22:00. 
| accept Sergeant Wilson's evidence that the email was a reiteration of his verbal 
briefing in terms of where he expected officers to be”**. Consequently, in the 
verbal briefing Sergeant Wilson provided identical instructions to those who 
attended it. PC Bullough accepted without equivocation that the instructions 
were sufficiently clear.”4* | agree with that assessment. 


7.32 The question then is, why were Sergeant Wilson's instructions not followed? 


7.33 PC Corke was the most experienced of those who had been allocated to police 
the concert that night. Sergeant Wilson's email directed him to deal with an 
unrelated matter before attending the Victoria Exchange Complex. At 21:00, 
although he had not completed that task,”“* PC Corke told Sergeant Wilson 
that he would be at the Arena for egress.”“* However, PC Corke did not attend 
Victoria Railway Station until 22:34.”4° He only did so in response to the requests 
for assistance after the explosion had occurred.”*° 


7.34 — Exactly when PC Corke finished dealing with his other task is not clear on the 
evidence.” What is clear is that PC Corke did not go straight to the Victoria 
Exchange Complex once he had completed it. Instead, he travelled with PC 
Matthew Martin in a police vehicle to Deansgate.”“8 PC Corke’s justification 
for doing this is that he was reliant upon PC Martin for a lift’? albeit that he, 

PC Corke, drove the vehicle.”°° PC Corke explained that he was not present 
at egress on the basis that he had mistimed his movements by “a couple 
of minutes".’”*! Given that on both PC Corke and Sergeant Wilson's evidence the 
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period for egress would begin by 22:15, at the latest, and, given that at 22:32 he 
was still on Deansgate,”°? PC Corke’s mistiming was substantially greater than a 
couple of minutes. 


7.35 Even accepting that there may have been good reasons for his absence, PC 
Corke should have communicated to the duty sergeant, who was Sergeant 
Peter Wilcock from 21:00, that he had been unavoidably detained. | do not 
accept PC Corke's evidence that it was not his responsibility to do this.’°° 


7.36 In relation to those who did attend the Victoria Exchange Complex for their 
deployment, all four took a break substantially longer than they were permitted. 
At 19:27, PC Bullough and PCSO Renshaw set off on a five mile journey to buy a 
take-away. They returned at 20:08. They then went to a private area within the 
station where they continued their break for a further 78 minutes, until 21:36, 
when they returned to the station concourse.’** During the latter 35 minutes of 
PC Bullough and PCSO Renshaw’s break, PCSO Morrey and PCSO Brown took 
their break, from 20:58 to 22:28. This meant that during the period 20:58 to 
21:36 there was no BITP policing presence within the public areas of the Victoria 
Exchange Complex, including the City Room. Each of these officers was entitled 
only to a break lasting, at most, one hour.’°° 


7.37 PC Bullough, PCSO Renshaw and PCSO Brown were candid in their acceptance 
that there was no good reason for the length of their breaks.”° PCSO Morrey 
stated he could not recall whether or not he took an unacceptably long break 
or not.’*” None of the four officers sought to provide any justification for why 
their breaks overlapped. 


7.38 There was a complete absence of any BTP officer in the City Room from 
around 22:00 until after the explosion. No satisfactory justification has been 
provided for this.” ACC O'Callaghan gave conflicting evidence in relation to 
why he believed Sergeant Wilson's email was not followed. On one hand, ACC 
O'Callaghan stated that it would be wrong to blame individual officers.””? On the 
other, he was adamant that the officers were adequately supervised’©° and 
they could be expected to follow the instructions they were given.’* He also 
accepted that a person is more likely to follow instructions if they had a clear 
understanding of the reasons for them.’& 
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7.40 


741 


7.42 


7.43 


Part 7 Policing of the City Room 


In my view there were a number of reasons why there was no BITP officer in the 
City Room from 22:00. 


It was partly because PC Bullough, PSCO Renshaw and PCSO Morrey failed to 
organise themselves in a way that followed Sergeant Wilson's clear instructions. 
That is not, though, the complete explanation. The lack of clear leadership 
from any police officer present within the Victoria Exchange Complex was a 
significant contributory factor to this failure. 


Having heard the evidence from each of those officers involved, | find that 

the absence of a person with the experience of PC Corke’®’ resulted in a lack 
of clear leadership on the ground. PC Bullough, the only police constable 

at the Arena, had joined BTP in July 2016 and had been operational from 
October 2016. She was not an experienced officer.”** She was still within her 
probationary period which was due to be completed in July 2018.” This was 
only her fifth deployment to police an event at the Arena.’ While PCSO Morrey 
thought PC Bullough was in charge,’ neither she nor PCSO Renshaw thought 
that she was.’°® Inspector Wedderburn’s evidence was that those present 
should have worked it out between themselves,’°? although she accepted that 
it was now Clear to her that officers deployed to police an event needed to be 
supervised.’”° An officer of PC Corke’s 30 years’ experience would have had 

a better grasp of how to ensure Sergeant Wilson's instructions were followed 
by all present. By reason of his length of service, PC Corke would also have 
had a greater natural authority. There should have been either a sergeant or 

an experienced constable on duty In the station complex to supervise the less 
senior and less experienced officers. 


It is important to take a step back and look at the evidence as a whole. All five 
officers allocated to the Arena that night failed to follow clear instructions and 
do what was expected of them in important respects. One explanation for this 
might be that, by chance, and, in different ways, each of them deliberately and 
consciously failed to act as they knew they should. An alternative explanation 
is that, in addition to the lack of leadership present at the Victoria Exchange 
Complex, more systemic, cultural factors were in play. 


All five officers had received appropriate counter-terrorism training.”” | have 
no reason to doubt that each of them would have been able to confirm in 
May 2017 what the terrorism threat level was had they been asked. However, 
having seen what they did’”” and heard what they have said about it, | find 
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7.44 


7.45 


7.46 


7.47 


that none of them had realised when on duty on 224 May 2017, that they 
needed to be alert to the possibility of a terrorist attack. With the exception of 
PCSO Brown, who was still under direct supervision, that is a significant failure 
on the part of each of the BTP officers who were deployed to the Victoria 
Exchange Complex. 


BTP, as an organisation, was principally responsible for this defect in the 
officers’ attitude. BTP failed to instil the necessary alertness into each of them in 
their day-to-day operation. 


ACC O'Callaghan acknowledged the difficulty with keeping police officers’ 
attention in briefings, when there was no new information. He likened this to 
the safety briefing at the start of a flight.’”* | accept that making information 
memorable is a real challenge which confronts every police service in 

the country. It means that careful thought must be given to ensuring that 
this challenge is overcome. The longer the threat level remains static, the 
more likely it is to get pushed to the back of the minds of those whose duty 
is to police events. It is the obligation of the organisation to ensure that the 
counter-terrorism message is received by those being briefed. 


This did not happen within BTP prior to 22" May 2017. ACC O'Callaghan stated 
his belief that terrorism was in the minds of all of the officers.” The approach 
by the officers on 22"? May 2017 to the discharge of their duties reveals that this 
was not at the forefront of their minds. 


Symptomatic of the absence of conscious, proactive thought in relation to the 
risk of terrorism was the approach to both written risk assessments and a written 
plan for policing events. The 2014 Tactical Report (or similar) was not used. 

The lack of a proper assessment of the risk In written form and the lack of any 
other written plan for policing of events at the Victoria Exchange Complex, 
reveal a failure on BTP’s part to give proper consideration to the threat from 
terrorism when deploying officers to police events at the Arena. The process of 
creating such documents compels thought to be given to threats and how they 
can be mitigated. This is capable of having real value by influencing the culture 
at all levels of command. This, in turn, is capable of affecting the attitude of 
those deployed on the ground. 
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8.1 


8.2 


8.3 


8.4 


8.5 


There are two sections to Part 8. This first section will set out and explain my 
recommendations. These are derived from the conclusions | have reached 
based on the evidence given about the security arrangements for the Arena. 
The second section will set out my approach to monitoring the progress 

of particular of the recommendations | make in Volume 1 (monitored 
recommendations). 


By issuing Volume 1 at this stage, | will be in a position to receive reports from 
those affected by and are responsible for the monitored recommendations 
while the oral evidence hearings are ongoing. | will seek these reports before 
the conclusion of 2021. 


As at the date of Volume 1, over four years have passed since the Attack. Some 
changes have been made at the Arena which provide greater protection for 
members of the public against terrorist attacks. | have concluded that more 
needs to be done. There remains a risk of further attacks which requires 
changes to be made without delay. 


The monitored recommendations are all in areas in which substantial progress 
can be made within the remaining period of the oral evidence hearings. 


The fact that | have not included a recommendation as a monitored 
recommendation does not mean it should not be followed. | will keep under 
review whether or not | need to seek any report in relation to those which are 
not monitored recommendations. 
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Guarding against complacency 


8.6 My overarching impression from the evidence is that on 22" May 2017 and in 
the lead up to the Ariana Grande concert, inadequate attention was paid to the 
national level of the terrorist threat by those directly concerned with security 
at the Arena. The threat level was severe. That meant that a terrorist attack was 
highly likely. 


8.7 None of those directly concerned with security at the Arena on 22" May 2017 
considered it a realistic possibility that a terrorist attack would happen there. 


8.8 If SMG had paid greater attention to the threat level, it would have taken more 
steps to mitigate the danger of a terrorist attack in the City Room on 22" May. 


8.9 If Showsec had paid greater attention to the threat level, it would have taken 
more steps to mitigate the danger of a terrorist attack in the City Room 
on 22" May. 


8.10 If Mohammed Agha and Kyle Lawler had considered the concerns expressed to 
them about SA in light of the threat level, they would have made greater efforts 
to ensure those concerns were reported to their supervisors. 


8.11 =‘ If BTP officers had that level of risk in their minds when they carried out their 
duties that night, they would not have been absent for such a long period 
from the public areas of the Victoria Exchange Complex. In particular, one of 
them would have been in the City Room in the half hour period before egress 
and therefore during part of the period that SA waited there before detonating 
his bomb. 


8.12 One of the reasons why inadequate attention was paid to the threat level was 
that it had been in place for some years. | make no criticism in respect of the 
length of the period during which a severe risk was Identified. As long as the 
threat level is severe, the appropriate level of vigilance must be maintained. 
The problem is that it becomes more and more difficult to ensure that people 
maintain the high level of alertness required in relation to potential dangers. 

A high level of alertness needs to be maintained when the threat level is severe. 


It is necessary to continuously remind those whose job includes being alert 
to the terrorist threat of the level of it and what that level means in relation 
to the possibility of an attack. 

8.13. There ought to be a risk assessment for every venue. A specific risk assessment 


for each event which involves the attendance of a substantial number of people. 
All risk assessments for large concert venues should include consideration of 
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the risk of a terrorist attack. Inadequate consideration of that risk may result in 
incorrectly identifying a low risk. This in turn may cause those responsible for 
security to be insufficiently alert. That is what occurred here. 


It was suggested during the evidence that this was unnecessary, as everyone 
knew the threat level of a terrorist attack and would have regard to it in the way 
they behaved. | do not agree. While in theory that may be true, the discipline of 
undertaking a risk assessment will assist in keeping the threat of terrorism at the 
forefront of the minds of those who prepare for the event. 


Robust procedures are necessary to counter the threat of a terrorist attack. 
The purposes of those procedures and the necessity of following them 
must be understood by those carrying them out 


8.15 


8.16 


8.17 


8.18 


8.19 


The following are three examples of procedures which should have been 
more robust. 


It needed to be made absolutely clear and to be understood by the BTP officers 
that patrolling the areas of egress in the half hour before the end of the concert 
was not optional, it was mandatory because of the security risk. There needed 
to be at least one experienced police officer on duty at the Victoria Exchange 
Complex on the occasions of concerts, preferably a sergeant, in addition to 
inexperienced officers, to ensure that nobody forgot the threat level and carried 
out their instructions with it in mind. 


The pre-egress checks carried out by Showsec ignored almost entirely the 
terrorist threat. Those checks concentrated instead on making sure that the exit 
routes for the crowd were clear. That was important but it was also important 
that there should have been a counter-terrorism aspect to the checks. 

Anyone who had the threat level at the forefront of their mind would have 
realised that. 


Showsec should have understood that its staff had a responsibility to check 
the mezzanine as part of a security patrol. SMG should have had a system in 
place to make sure that security patrols were taking place and being carried 
out properly. 


In order for necessary security procedures to be maintained, each person needs 
to be reminded of the counter-terrorism aspect of their activities. The message 
that counter-terrorism measures are vital needs to be constantly reinforced. 


Those responsible for security should be briefed at every event about the 
current threat level and risk of terrorist attack. 


8.20 


| accept that repeating the same warning about terrorism as part of each 
briefing creates a risk of it being ignored and those who have heard it before 
may listen less than attentively. 
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8.21 


8.22 


8.23 


The evidence | heard from Showsec is a good illustration of this issue. 

The Showsec supervisors’ and stewards’ briefings on 22" May 2017 both include 
the importance of being vigilant for suspicious behaviour. As the events which 
followed demonstrate, that was insufficient to keep people safe. However, the 
fact that this measure was not effective on this occasion is not a reason to 
abandon it. Rather, it is a reason to do it better. 


Those receiving the warning about the risk of attack have to be aware of the 
potential that they will become desensitised to the message. Those giving the 
warning need to be aware of this and must try to refresh the message so that it 
is sufficiently updated and relevant to attract the attention of the listener. 


Showsec operated a system of having a period within the supervisors’ 
briefing for a particular topic which was selected from a number of possible 
options, one of which was counter-terrorism. This was, in my view, a good 
way to ensure that additional detail was provided without the subject matter 
becoming stale. 


Any and all suspicious behaviour by event-goers or members of the public 
close to a venue must be noted. It must be reported promptly so that 
investigations can be made and action taken, if appropriate. 


8.24 


8.25 


8.26 


When this recommendation is followed there will be false alarms. While this 
may be frustrating, it is important that the way false alarms are dealt with does 
not discourage the reporting of suspicious behaviour. If unnecessary reports 

are made, the remedy should be to train staff better to recognise suspicious 
behaviour, rather than criticise them for making the report. It is not easy for staff, 
particularly junior ones, to make reports that they know may result in disruption 
to an event or inconvenience a large number of people. They need to be given 
the confidence to do so. 


Bomb hoaxes can cause great inconvenience, but no-one can safely ignore 
bomb warnings. So it is with suspicious behaviour. It should only be ignored 
when an innocent explanation has been verified. There was evidence 

of a number of such false alarms during the Inquiry, but staff should be 
congratulated and not criticised either expressly or implicitly for raising 

the alarm. Showsec and SMG were clear that they did their best to get this 
message across but, on the evidence, it did not seem to have got through to all 
of their staff. In particular, the system for capturing reports and ensuring their 
proper investigation was not sufficiently robust. 


Where hostile reconnaissance is suspected it needs to be properly recorded 

and reported to the police. The police should investigate it and report back. 
Briefings to security staff need to include details of the suspected hostile 
reconnaissance. This is so that staff Know what has happened and know what to 
look out for. 
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The Protect Duty 


8.27 


8.28 


8.29 


8.30 
8.31 


8.32 


8.33 


A consequence of the Attack has been that impetus has been given to the 

idea of introducing primary legislation putting in place a ‘Protect Duty’. That is 
an obligation for those with responsibility for publicly accessible locations to 
consider and, where required, implement security measures in order to protect 
the public. The government proposes to Introduce the necessary legislation and 
is conducting a Consultation on what it will contain. 


During the hearings in 2018 of the Intelligence and Security Committee of 
Parliament into the 2017 attacks, Counter Terrorism Police told the Committee 
that a Protect Duty was “not something which seems likely at the moment 

in law". 


In its report which included recommendations, at Recommendation LL the 
Committee said at page 104: “...we remain concerned that there appears to be 
no way of mandating owners of public places to install necessary protective 
security measures where they do not do so voluntarily. This issue becomes 
yet more difficult where sites have multiple owners. The Government should 
consider clarifying the legal responsibilities of both site owners and relevant 
public authorities in this regard.” 


Things have clearly moved on. 


The progress is a testament to the efforts of Figen Murray, whose son Martyn 
died in the Attack. In his memory and in recognition of Figen Murray's work, the 
proposed new legislation has become known as ‘Martyn’s Law’. Everyone who 
took part in the Inquiry has rightly paid tribute to her efforts. 


Legislating for a Protect Duty is an ambitious project. It is intended to put in 
place legal requirements which will apply to all spaces to which the public 

have access. There have been other schemes which have been designed to 
protect the public in crowded spaces. These have been more limited in scope 
and have not been wholly successful. The first was targeted at buildings which 
were considered to be ‘vulnerable’. The most recent one was aimed at crowded 
spaces which would be ‘attractive’ as targets for terrorists. This is the one which 
the Arena accessed through the input of a CTSA. | have dealt with that scheme 
in relation to the Arena in detail in the course of Volume 1. 


There were drawbacks to both the schemes which were implemented 

through CTSAs. The first was that they applied to a relatively limited number 

of locations and, perhaps more importantly, they were voluntary schemes and 
occupiers of premises were not obliged to implement recommendations made 
by CTSAs. As | have already said, SMG did take up the offer of assistance and did 
implement recommendations which had been made. The shortcomings in the 
scheme as it affected the Arena are made clear in Volume 1. 
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8.35 


8.36 


8.37 


8.38 


8.39 


8.40 


8.41 


The idea of a more comprehensive Protect Duty has been under consideration 
for anumber of years. DAC D’Orsi said that she had been an advocate for it ever 
since she took up her previous job dealing with terrorist cases. Shaun Hipgrave, 
who is in charge of policy around the Protect Duty at the Home Office, has also 
been a supporter for some time. The need for a different scheme was partly 
because of the lack of success of the previous schemes and also because of the 
change in the methodology of the attacks carried out by terrorists. 


The government proposal is very wide ranging and, while simple in design, it will 
be complicated to put into operation. The proposal is that the Protect Duty will 
apply to every space to which the public has access so that wherever members 
of the public go within a public space some person or organisation will have the 
responsibility to take steps to protect them against a terrorist attack. 


The Consultation considers three different areas to which a Protect Duty 
may apply. First, public venues which are capable of accommodating an 
audience in excess of 100; second, large organisations employing more than 
250 people; and third, public spaces. Each of these different categories will 
cover a wide variety of locations with very different levels of risk. 


The Inquiry has been concerned with a large arena which comes within the 
first category. Very different issues may arise for the Protect Duty for the second 
two categories. 


| have not heard evidence and | have not considered submissions on how 
to make large organisations or public spaces secure, so | will restrict myself 
principally to dealing with the proposed Protect Duty as it applies to large, 
public venues. Some of my observations will be relevant to the other 

two categories. 


There is already legislation which is capable of requiring consideration of the 
risks of a terrorist attack in some buildings. As is correctly pointed out by the 
government, existing legislation does not cover all the areas that they wish a 
Protect Duty to cover. A Protect Duty Is therefore needed in addition to existing 
legislation, but it does not mean that existing legislation should be ignored. 


Whenever a new Protect Duty has been considered, questions of proportionality 
have arisen. It is important that, as far as possible, the risk of a terrorist 
succeeding is eradicated or minimised. While we look to the Security Service 
and Counter-Terrorism Police to discover plots before they can come to 
fruition, they cannot prevent every terrorist plot as they themselves have said. 
That is not a reflection on how they do their jobs, it is the reality. Nor is it any 
comment on whether SA's plot could or should have been stopped by the 
Security Service and Counter-Terrorism Police. | shall be considering that issue 
in Volume 3 of the Report. 


Doing nothing is, in my view, not an option. Equally, the Protect Duty must not 
be so prescriptive as to prevent people enjoying a normal life. 
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Working out what is a proportionate response is a matter for society through 
Parliament. Any increase in protective measures Is likely to affect both 

those implementing them and may affect members of the public. | have 
seen the horrific outcome of the Attack on 22"7 May 2017 and the appalling 
consequences it has had for the bereaved and survivors. | recommend that, 
when considering what is the appropriate Protect Duty for premises like the 
Arena, a high standard of protective security Is justified. 


An important question for the government will be whether setting the level for 
the Protect Duty in the first category at venues with a capacity of 100 or more is 
workable. Very different issues will arise for venues capable of accommodating 
an audience of only 100 people and one capable of accommodating many 
thousands such as the Arena. 


The Consultation’s stated aim is for “light touch" regulation. While that may 

be justified when dealing with smaller venues, it seems to me that different 
considerations should apply to larger commercial premises. Not only are the 
potential consequences so much more serious but, for that reason, these 
premises are more likely to attract the attention of terrorists. They are also likely 
to have greater resources to put protective measures In place. 


| recommend that when considering the shape of the legislation, the 
government considers whether it will be necessary to have further categories 
above the 100 capacity. While categorising by capacity may be the most 
straightforward way of deciding on the nature of the Protect Duty to be 
imposed, there may be other factors that need to be considered. For example, 
it may be appropriate to use different capacities depending on whether the 
venue is indoors or outdoors. This will need to be considered. 


For venues capable of accommodating large audiences, it seems to me that 
considerations of eliminating or reducing risk from terrorist attacks should be 
part of the pre-building process. Once premises are constructed, it may be that 
compromises in the discharge of the Protect Duty will be reached to enable the 
premises to trade. For example, one of the principal reasons that SA was able to 
detonate his bomb was the difficulty of making the City Room secure because 
of its design and use. 


| consider it is important that before premises are built, or there is a change of 
use, consideration is given to whether the design is suitable for providing the 
level of security required by the Protect Duty. In the end, it would be better 
for developers to Know in advance whether their building was likely to comply 
with any Protect Duty rather than face difficulties after they have constructed 
the building. 


Safe means of entry and egress can be considered before the premises are built, 
so that security difficulties such as those caused by access through grey spaces 
can be resolved. The nature of the risks and threats from terrorists change, as 
we have seen over the past decade. While it may be impossible to consider 
every possibility at the construction planning stage, many could be. 
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8.52 


There are already statutory requirements which could cater for this. It could 

be done as part of the construction planning or the licensing process. 
Considerations of public safety are already part of the licensing process and 
there is no reason why consideration of the vulnerability of a terrorist attack 

in new premises should not be part of the planning process. | understand this 
could come within the present planning legislation, but if a widening of the 
ambit of planning permission was required, there is no reason why that could 
not be achieved by government guidance or, if necessary, the primary legislation 
which will be required to introduce the Protect Duty. 


Similar considerations apply to licensing permissions. Any building such as 
the Arena would require a licence to permit public entertainment and the sale 
of alcohol. Public safety has always been a consideration in the granting of 
licences and the clear terms of the Licensing Act 2003 mean that it still is. 


| recommend consideration is given to these matters when legislating for a 
Protect Duty. The Home Office, in their submissions to me, indicated that they 
will consider reviewing the Licensing Act 2003 guidance once a Protect Duty 
has been brought in. An addition to that guidance is all that would be required. 
Any change in the guidance needs to be consistent with a new Protect Duty 
and there seems no reason why it should not be issued at the same time as the 
introduction of the new duty. 


When dealing with large venues such as the Arena, | see no reason why 
regulation as part of the Protect Duty should not be rigorous. Regulation dealing 
with other matters of public safety such as food hygiene is rigorous. | do not 
see why prevention of terrorist attacks should not be treated in the same way. 

It would be comforting to think that threats from terrorist groups might be 
short-lived but there is no evidence to support that. 


The Duty 


8.53 


8.54 


8.55 


8.56 


In my view there should be the following requirements as part of the Protect 
Duty when dealing with large premises. 


First, it will be necessary to identify what the nature of the duty will be. 


There already exists a statutory form of words which Is appropriate to define the 
extent of the duty, so it is unnecessary to create a completely new formulation. 
| recommend that a formulation of the duty could be to take such steps as are 
‘reasonably practicable’ to ensure the security of members of the public while 
they are on land, or in premises, with express or implied permission to be there. 
Members of the public falling into this category will be those to whom the 
Protect Duty is owed. It should include employees of the Protect Duty-holder. 


The meaning of reasonably practicable is well established. It is used within 
health and safety legislation which will have some similarities to a Protect Duty. 
| have included a new concept of ‘security’. My recommendation is that security 
in terms of a Protect Duty should mean protecting those to whom the Protect 
Duty is owed from harm as a result of a terrorist attack. 
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The next step will be to identify who should be subject to a Protect Duty. That 
is not necessarily a straightforward exercise. Identification of the persons and 
organisations subject to the Duty needs to be simple. 


The Consultation proposes that the Protect Duty should fall on the owners of 
land and occupiers. That seems a sensible starting point. Depending on the 
circumstances, it may be easy for owners to discharge their duty. For example, 
the owners of premises like the Arena are likely to discharge their Protect Duty 
by contractual obligations imposed directly on the occupier or on the head 
lessee who can then pass them on to the occupier. It would then be a matter of 
the application of the reasonable practicability test to decide whether more was 
required of an owner. This will depend on the individual circumstances. 


Deciding who is subject to the Protect Duty becomes more difficult in relation 
to areas over which a number of people have rights. When considering an area 
such as the City Room, there may be an owner, a head lessee and others who 
have premises adjacent to it who have rights for themselves and their customers 
to pass over it. All of these could, and probably should, have a Protect Duty over 
the parts of the common area which their visitors use. The extent of that may 
depend on the type and amount of use they make of the common space. 


Deciding who has a Protect Duty in relation to a shared space, what the extent 
of each duty Is and how the duty is going to be fulfilled by the different parties 
will be difficult. In the case of the Arena the problem did not arise as, by virtue 
of the facilities management agreement, SMG were contractually responsible 
for security in the City Room. Reaching such a contractual arrangement 

would be sensible and may be necessary but may not be readily reached In 
some cases where such a communal space exists. Imposing a Protect Duty by 
legislation on, for example, owners of shopping arcades which they never had in 
their contemplation at the time they let units in the arcade, is capable of leading 
to unfairness. 


As suggested in the Consultation, the preferred way of dealing with any 
problems between different Duty-holders would be to encourage agreement 
between the various parties as to how they should collectively discharge the 
Protect Duty. It has to be recognised that that may not be possible, anda 
mechanism may have to be considered to enforce a resolution. 


| recommend consideration of a Protect Duty on others who have no legal 
interest in the property but have responsibility for security. For example, 
Showsec who were involved in crowd management and security, activity which 
Showsec accepts had a counter-terrorist element, would not be covered by 

an ownership or occupation-based duty. On the evidence that | have heard, 
there is a strong case for making an organisation, such as Showsec, subject to 
such a Duty. It may be that this can be provided for contractually between the 
owners or occupiers of the premises and any company employed by them to 
provide security, but there could be difficulties where the contract is already 

in existence. 
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8.63 


8.64 


There may be a decision to be made as to whether the government will itself be 
made subject to a Protect Duty or whether some government agencies will be. 
Police services would not be covered by a property-based Protect Duty except 
on their own land. While the Police would, no doubt, be required to protect the 
public from a terrorist attack without such a duty, the existence of a positive 
Protect Duty might provide a framework and reinforce the need for constant 
vigilance. One of the matters revealed by the evidence given at the Inquiry 

has been the difficulty in keeping people aware of the risk of a terrorist attack, 
particularly when the threat level remains the same for a long period of time. 


Local authorities provide protective security through the operation of CCTV 
which does not cover land that they own. It is important that the operators of 
CCTV have sufficient training to observe hostile reconnaissance and suspicious 
behaviour and it may be that consideration should be given to making local 
authorities subject to a Protect Duty. 


Communication, coordination and co-operation between those with a 
responsibility for Keeping the public safe 


8.65 


8.66 


8.67 


8.68 


8.69 


One of the recurring themes of this Inquiry has been the need for 
co-operation between different people and organisations in the interests of 
everybody's safety. All employers are already under this duty by reason of the 
health and safety regime in relation to shared workspaces. 


All those concerned with or occupying the Victoria Exchange Complex in which 
the Arena was located should have been co-operating together over security, 
particularly those working in the station and the Arena. 


The CTSA advising the station and the CTSA advising the Arena should have 
carried out at least part of their security assessment together. Showsec should 
have been involved with the CTSA when security matters were discussed 

with SMG. 


BTP should have liaised more closely with both SMG and Showsec. Each should 
have Known what the other was doing, so that the protective measures each 
provided were complementary. Showsec, in submissions to me, argued that 
once the audience members left the Arena and entered into the City Room, 
primary responsibility for their safety from a terrorist attack was on BTP as this 
was a ‘public space’.’”” As a matter of fact and law, | do not believe that that 

is accurate. The City Room was a privately owned space, in to which the public 
was permitted except between 00:00 and 05:30 each day. 


Whether or not it is accurate as a matter of law, it reflects in my view the wrong 
attitude to approaching the terrorist threat. While we enjoy the freedoms 

that we do, no police service or the Security Service can hope to eliminate all 
terrorist threats. It is up to everybody to carry out their part in trying to prevent 
terrorist attacks. Co-operation is required from everybody and attempts should 
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not be made to pass on responsibilities to others. It is to be hoped that a Protect 
Duty will achieve this by legislation, as commercial pressures may mean that it 
will not be achieved on a voluntary basis. 


In my view, the Protect Duty should include a requirement that, where there Is 
more than one Protect Duty-holder in relation to any particular protected space, 
that person should co-operate, communicate and act in a coordinated manner 
with other Protect Duty-holders in order to discharge their own Protect Duty. 


Summary of the Protect Duty process 


8.71 


8.72 


The exact mechanics of how the Protect Duty will work in practice will be a 
matter for Parliament to determine. However, | recommend that it will need to 
include the following stages: 

1) The Protect Duty-holder must assess the risks. 


2)  Intlight of the risk assessment, the Protect Duty-holder must decide 
what needs to be done to mitigate the risks. 


3) |The Protect Duty-holder should carry out the actions which have 
been identified. 


4) There should be a system of checking that the actions have been 
carried out. 


5) If there has been a failure to carry out the actions, enforcement action 
should follow. 


| make some suggestions as to the detail below, which | hope will assist. 


The Protect Plan 


8.73 


8.74 


Central to the whole process of discharging the Protect Duty should be the 
preparation of a comprehensive risk assessment, the identification of the control 
measures and an explanation of how these will be implemented. | will refer to 
this as a ‘Protect Plan’. It may well be possible that for smaller venues or open 
spaces, a Protect Plan could be prepared by the owner from a generic list of 
options. That does not seem to me to be feasible for large venues. It does not 
seem unreasonable to me that large commercial venues, for which preparation 
of risk assessments and solutions may be complex, should have to pay for the 
preparation of the Protect Plan whether by retaining a consultant or employing 
someone for that purpose. 


Experts assisting In the completion of the Protect Plan will require specialist 
training and a minimum standard of accreditation will ensure that those 
undertaking this very important task are properly equipped to do it competently. 
It will be for the security industry, in collaboration with government, to ensure 
that there exists a recognised standard of training, a ‘kitemark’ of approval 

and ongoing continued professional development. It may be that the Security 
Industry Authority could have a role to play in setting the standard. 
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8.76 


8.77 


8.78 


8.79 


In some cases, the steps required of Protect Duty-holders will be obvious and 
straightforward. In these cases expert input may be disproportionate. These 
Protect Duty-holders should be able to take the necessary steps by accessing 
publicly available information as to how they should approach their tasks. 
Below | make recommendations as to how NaCTSO may be able to make a 
contribution to ensuring the required information is available to those who 
need it. 


In cases in which preparing the Protect Plan is not straightforward and the 
Protect Duty-holder, such as a charity, does not have the means to pay for 
assistance, consideration should be given to providing state help for the 
preparation of the Plan and its implementation. 


The Protect Plan should set out the ‘reasonably practicable’ measures to be 
taken to mitigate the risk of a terrorist attack. 


Once prepared, in some cases the police and other state agencies may wish to 
have an input into the plan before it finalised. 


A timetable will need to be set. There will need to be provision for regular 
reviews and enforcement process. Reviews will not only be needed to ensure 
that the Protect Plan is still being implemented but to consider possible changes 
if the terrorist threat alters. 


Selecting appropriate staff 


8.80 


8.81 


The Protect Plan should identify which roles will include a 

counter-terrorism element. These roles are essential to the successful 
discharge of the Protect Duty. It is critical that those undertaking these roles 
are selected with care. This will include ensuring that they have the necessary 
maturity and confidence to speak up should the situation arise. It should also 
include ensuring a background check proportionate to the role that they are 
undertaking has been conducted. 


| recommend that the Protect Plan identifies the approach which will be taken 
to ensuring that only appropriate people undertake work which includes a 
counter-terrorism element. 


Adequate training 


8.82 


Part of the Protect Duty proposals include the provision of training in 
counter-terrorism. The higher-level training provided by the SIA for employees 
occupying certain positions should be retained but it is important that managers 
and all employees have some training. ACT which is a training scheme set up 

by NaCTSO is suitable for people working in the industry at all levels. All people 
working in venues such as the Arena should be trained in the basics of 
counter-terrorism. The nature of the threat changes so it is important that there 
is regular refresher training. 
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The provision of adequate training should form a key control measure within the 
Protect Plan. This will include consideration of the need for enhanced training 
for those in roles which require It. 


| recommend that staff training should form a mandatory part of the 
Protect Plan. 


Rigorous and robust enforcement 


8.85 


8.86 


8.87 


8.88 


8.89 


It was a common feature of the regulatory schemes that | have heard about 
during the Inquiry that there were insufficient resources to carry out proper 
enforcement. The consequence of that is that there have been a number 
of breaches of regulations which might have been avoided with more 
active enforcement. 


It is important that there is proper enforcement of the Protect Duty, the 
possible consequences of breaches are so serious that proper steps need to 
be taken to avoid them happening. It is possible that CTSAs, licensing officers, 
police licensing enforcement officers and the SIA could all combine to provide 
enforcement. Even if that happens, it is likely that more people will be required 
to carry out the work. When cutbacks occur, enforcement can be one of the 
first areas to lose staff. It would be a false economy in relation to enforcement 
of the Protect Duty. | recommend that an adequate and effective enforcement 
process is established in relation to the Protect Duty. 


The proposal is that there should be a system of enforcement to ensure that 
the terms of the Protect Plan which has been determined are complied with. 

| am satisfied on the evidence that | have heard that there needs to be an 
enforcement mechanism and the ability to impose a penalty if there is a breach. 
Part of the reason for the failure of other schemes has been that they have been 
voluntary. The Consultation suggests that the penalty should be restricted to 

a civil penalty which would be financial. In those circumstances there would 

be no conviction. While it is not unusual to have civil penalties for regulatory 
failures, provision is often made for criminal prosecutions and more severe 
penalties in more serious cases. | would recommend that the same should apply 
for breaches of the Protect Duty. It should be borne in mind that this is an area 
where the possibility of a severe sentence could have a deterrent effect. 


In my view, there is no good reason to put In place an enforcement regime that 
is any less rigorous or robust in terms of inspection, enforcement and penalty 
than that which exists in the parallel health and safety legislation. Given what is 
at stake, namely the lives of people going about their everyday business, there is 
every reason to make the Protect Duty equally rigorous and robust. 


Whatever the legislature decides about penalty for breach, inspection and 
enforcement Is likely to be the main deterrent. A proper inspection regime 
needs to be in force so that serious security breaches are identified and 
promptly remedied. Even if enforcement is regarded as light touch it is 
important that there is proper inspection. An effective enforcement regime 
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8.90 


8.91 


8.92 


requires sufficient people to do it properly. All the evidence that | heard suggests 
that insufficient resources have been put into the present inspection regimes. 

A proper inspection policy should provide for unannounced inspections as 

well as planned ones. It may be that the roles of different inspectors can be 
combined so that for example inspectors looking to see that the Protect Duty 
was being complied with could also be checking in appropriate locations that 
licensing conditions are being observed. 


| envisage that this may follow a similar approach to that used in relation 

to health and safety and food standards. By this | mean the existence of a 
mechanism for issuing a formal notice setting out the remedial steps which are 
required in relation to any identified deficiencies. For extreme situations, there 
must be provision for issuing a notice that prevents a venue from operating 
until remedial steps have been taken. The notice will provide a timescale 

for compliance. It will also be necessary to have an appeal process for the 
adjudication on the appropriateness of the terms of the notice, should there be 
a dispute. It should be a criminal offence to fail to comply with a valid notice 
without reasonable excuse. 


Operators, and people who work for them, are often under financial pressure 
to try and make savings as has been evident during this Inquiry. | understand 
that is the commercial reality, but it does mean that a proper inspection regime 
is needed to give some assurance that savings will not be made at the cost 

of safety. The security measures may be expensive. It must be more costly 

to an organisation and individuals to cut corners than to comply with the 
Protect Duty. 


| recommend that enforcement of the Protect Duty is at least as robust and 
rigorous as comparable regulatory regimes. 


Communication, coordination and co-operation between enforcement 
authorities with overlapping regimes in connection with the Protect Duty 


8.93 


8.94 


The various regulatory bodies who have responsibility for safety at premises like 
the Arena need to operate together. CTSAs, the SIA, the Licensing Authority, the 
Health and Safety Executive and the police all have responsibilities for public 
safety at premises of this kind. They need to understand what each of them is 
doing in relation to any particular premises so they do not duplicate but can 
provide complementary services. | will be reviewing the progress of this as part 
of my monitoring of the Protect Duty. 


| recommend that regulators and other state agencies with responsibilities that 
engage with any Protect Duty co-operate, coordinate and communicate. 


Mandatory first aid training for staff of those under Protect Duty 


8.95 


As well as looking at measures aimed at preventing a terrorist attack, 
| recommend that the government should also look at simple measures to 
help to save lives should an attack occur. It has become clear to me during the 
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evidence that it would be beneficial if employees of companies which have a 
Protect Duty, including SMG and Showsec, were trained in first aid relevant to 
injuries of the type caused during the Attack on 224 May 2017. 


| recommend that Protect Duty-holders are required to ensure that employees 
are trained in first aid relevant to injuries which are particularly likely to occur 
during a terrorist attack. 


Centralised NaCTSO library of training materials 


8.97 


8.98 


The suggestion made by Showsec that NaCTSO should set up a centralised 
online library where it will be possible to access training material is a good one. 
This will help in particular smaller organisations who cannot afford to employ 
professional help to assist them with a Protect Duty. Thought will need to be 
given to how access might be gained to this to ensure that this information is 
not misused by those seeking to do harm. 


| recommend that NaCTSO sets up a centralised online library for training 
materials freely accessible to those subject to the Protect Duty. 


Generic guidance in relation to the completion of risk assessments in 
relation to the threat of terrorism 


8.99 


8.100 


8.101 


The approach taken by SMG in its written risk assessments involved a numerical 
assessment of the likelinood of a terrorist attack. This was then used as a 
multiplier against a severity score. | have considerable reservations about this 
approach being used in connection with the threat from terrorism. This concern 
arises from the potential that a strictly statistical approach may suppress any 
total score to the point where the risk of a terrorist attack is regarded as being 
sufficiently low as to be acceptable and no action is taken. 


There are at least three ways that this could be addressed. One option is to 
remove consideration of likelinood from the process altogether. This will result 
in a focus on what can be done without providing for an opportunity for the 
thought, ‘It will not happen to me’, entering the process. Another is to import it 
only in relation to drawing a distinction between different attack methodologies. 
Some spaces may be naturally highly protected from a particular form of attack. 
In those circumstances, having a mechanism to ensure focus is on the more 
likely methodologies may be advantageous. A third approach may be to ensure 
that the severity score range is sufficiently wide so that even when a low 
likelinood is applied, the total score still remains high enough to produce the 
necessary measures. A high severity score is clearly justified when considering 
the very high degree of harm a terrorist attack is capable of causing. | do not 
believe that a range of between 1 to 5, as was used by SMG, is sufficiently wide. 


However, | have not heard sufficient evidence to express a concluded view 
on the best way to complete such a risk assessment. Nor have | heard expert 
evidence on the subject to inform me. In my view, NaCTSO is likely to have 
access to the necessary expertise to consider this issue in detail, identify the 
best approach and Issue readily understandable guidance. 
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8.103 


The Health and Safety Executive makes publicly available, via its website, 
guidance on the completion of a risk assessment, together with a template in 
the health and safety context. 


| recommend that a similar facility should be made available by NaCTSO in 
relating to the risk of a terrorist attack. 


The SIA 


8.104 


8.105 


8.106 


As | have already set out, the SIA licences individuals working in the security 
industry to carry out certain activities. Amongst those activities is operating 
CCTV over a public space. At present, a licence is only required by those who 
monitor CCTV under a contract for services. In-house CCTV operators do not 
need a licence. Although an attempt was made to justify the reasoning for this 
distinction by Tony Holyland, a senior employee at the SIA, | was unpersuaded. 
This distinction has been considered in the past, but no change has been made. 
In-house operators carry out the same job as those who monitor CCTV under 
a contract for services. The Inquiry heard evidence that more than one SMG 
employee who carried out monitoring of CCTVs asked for training but were 
not given it. There seems to me to be no persuasive reason why a licence 
should not be mandatory for those operating in-house as well as those working 
under a contract for services. | recommend that the distinction is abolished. 

All of those who monitor CCTV should be required to hold an SIA CCTV 
operator's licence. 


In addition to licensing individuals, the SIA runs an Approved Contractor Scheme 
(ACS). This is a voluntary scheme and, while individuals who carry out security 
work may require a licence or licences depending on what functions they carry 
out, companies who provide security and supervise these activities do not. 
While the ACS provides assurance that the member is a fit and proper person, 
there Is nothing to prevent someone who is not a member of the scheme 
setting up and running a company providing security services. The SIA promotes 
good practice through its ACS. But there is no compulsion on companies to 
become a member or carry out good practice. While checks are made on 

how a company conducts its business when it applies to join the scheme, 
self-certification plays a considerable part in the process. 


| recommend that consideration is given to amending the SIA legislation to 
require that companies which carry out security work which may include a 
counter-terrorism element are required to be licensed. This will ensure that 
only fit and proper companies carry out this work. It will also ensure that they 
are aware of and guard against the risks of terrorist attacks at the events where 
they operate and carry out proper procedures, including training to mitigate 
those risks. 
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Training 


8.107 


8.108 


8.109 


Training for an SIA qualification is designed to be mainly classroom-based. 
The SIA does not provide the training itself nor does it award the qualifications, 
that is done by independent providers who are subject to quality control. 

The SIA decides what areas the training has to cover. It is important that the 
quality of the providers is maintained but, providing that happens, it seemed to 
me to be a satisfactory system of training. 


Training providers for the SIA qualification are not meant to rely to a large extent 
on document-based online teaching, sometimes referred to as e-learning. 
While e-learning is a convenient method of teaching large numbers of people 
without having to get them all together, the evidence at the Inquiry was that 

it is difficult to ensure that the training is properly carried out and it may be 
possible for the student to make it look as if the training has been done when 

it has not. That was the case with at least one of the employees of Showsec. 
There was another example of a Showsec employee doing e-learning on his 
mobile phone which its unlikely to have been a suitable way to ensure adequate 
training. Simply using good quality e-learning material is not sufficient. What is 
important is ensuring that the trainees have absorbed the learning. As was 

said in other contexts in the Inquiry, the learning needs to become part of the 
‘muscle memory’. | recommend that there should not be undue reliance on 
e-learning and its limitations need to be recognised. 


| recommend that if e-learning is used, there should be follow-up to ensure 
that the training has been understood. This can either be done while the job is 
being carried out or in a classroom. If this follow-up is carried out while the job 
is being carried out, it should be timetabled and recorded. 


Should the period of training be paid for by the employer? 


8.110 


8.111 


8.112 


The SIA says that even with employees who are licence holders, it expects 
employers to provide continuous training. An issue arose as to whether training 
should be provided during paid time or during the employees own time. 

It seemed to be generally accepted within the security and crowd control 
industry that stewards who have been accepted for work but have not yet 
started should do their basic training during their own time. 


The reason for this is that people who have been accepted as employees not 
infrequently do not take up the job, having found something else to do. While it 
is understandable that future employees are not paid for this time, it provides 
an incentive not to do the training especially as the training at that stage is most 
frequently e-learning. This makes it all the more important to ensure that new 
employees have diligently undertaken this training. 


| recommend that employees should get further training after they have 
started their employment and they are paid for that training time. Training is 
important and it requires both employees and employers to take it seriously. 
Giving payment for doing it would encourage this and ensure that employees 
realise that employers take it seriously. 
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8.113 


8.114 


8.115 


8.116 


8.117 


8.118 


The issue of primacy is relevant to both Volumes 1 and 2 of my Report. For that 
reason, | will not be giving any final recommendation on primacy until | publish 
the part of the Report which deals with the emergency response. | have received 
from BTP and GMP an interim memorandum’” on the policing of the Victoria 
Exchange Complex for which | am grateful and which | have considered. In case 
it may be helpful, | will set out my present thinking on the evidence that | have 
heard so far. While there may be other sites where similar considerations arise 
and my recommendations may be relevant to them, | do understand that 

the issues at different sites are likely to be unique both in terms of location 

and resources. 


It is important that any decision about this is made solely on the basis of 
providing the best policing service for the public. There is always a risk that 
decisions will be influenced by a desire to retain areas of work because to do 
otherwise may be perceived as a of lack of competence. Equally, there can bea 
desire to take over another area of work to increase the influence and reach of a 
particular organisation. 


As | set out in Part 7, BTP officers have jurisdiction to act with the powers of 
a constable in the Victoria Exchange Complex because of the ownership of 
the site by Network Rail. GMP officers also have such jurisdiction. They are 
concurrent jurisdictions. During the evidence it seemed that this fact was not 
clear to all officers. It is this that makes it necessary for a decision to be made 
on primacy. 


It makes sense to me that routine policing of the City Room, by which | mean 
policing on days when there is no event taking place at the Arena, should 
remain with BTP. BTP will be on site because its officers police the station. As a 
result of BTP’s policing of the City Room to date, its officers have formed good 
relationships with the occupiers of the whole Victoria Exchange Complex and 
there is no suggestion that they have not done routine policing satisfactorily. 


On event days, the situation is different. If there were to be a major incident 
connected with the Arena, it is inevitable that GMP would become involved in 
dealing with it. It is always likely to be the position, and certainly is the case now, 
that GMP will have greater resources immediately available than BTP in order to 
deal with a major incident in Manchester. 


The handling of major incidents by BTP is done from Birmingham and/or 
London. While it is possible to do this with the assistance of modern technology, 
there will always be advantages in dealing with the matter locally if, for no other 
reason, because of a greater knowledge of the area. 
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If GMP are going to have to deal with any major incident arising from an event, 
it would seem sensible that GMP should be in charge of the policing intended 
to prevent a major incident happening. It would also have the additional benefit 
that GMP would be on site if anything was to happen. Although it is a matter of 
detail which is best decided by the individual police services, there seems to me 
to be good reason for primacy to transfer before the doors open for the event 
and transfer back a short period after the doors are closed. 


Finally, GMP may already be involved in policing any crowd leaving the Arena 
when they come onto the street and it would be convenient for GMP to police 
the area right up to the time when the crowd has dispersed from it. 


This does not mean that BTP would have nothing to do with the crowd who 
attended events at the Arena. BTP would be under a duty to ensure their safety 
and the safety of railway users as they passed through the station to reach 

the road. It would inevitably be a combined operation so there should be 
continued liaison between BTP and GMP over policing associated with events. 
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Process of monitoring 


8.122 | have numbered those recommendations | intend, at this stage, to monitor and 
review. This is solely to assist in this process. The numbering is not intended 
to indicate importance or priority. The order broadly follows the sequence in 
which they appear in the first section of Part 8. 

8.123 | shall seek evidence about these recommendations before the end of 2021. 
Those from whom | will seek evidence are listed below each of the monitored 
recommendations. The Solicitor to the Inquiry will contact those who are 
identified at the appropriate time. 

8.124 When the time comes for reviewing the progress of implementation, | will 
permit Core Participants to make submissions to me to assist me in my review. 

8.125 It should be understood that | intend to scrutinise what has been done in 
response and use all the powers available to me, if required, to achieve 
transparency and accountability. 

Monitored recommendations Reporter 

MR1 Improvements, to the extent that they have e SMG 
not already been made, should be made at 
the Arena to address the failings identified 
in Volume 1. Specific consideration should 
be given to how to address my concerns in 
relation to complacency. 
MR2 | Improvements, to the extent that they have e Showsec 
not already been made, should be made by 
Showsec to address the failings identified 
in Volume 1. Specific consideration should 
be given to how to address my concerns in 
relation to complacency. 
MR3 | BTP should address the systemic failings « BITP 
identified in Volume 1, so as to ensure that 
they are not repeated. 
MR4 _ A Protect Duty, as set out above, should be e HMG (the Home Office) 
enacted into law by primary legislation. « NaCTSO 
¢ OSCT 
« CTPHQ 
« CPNI 
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HMG (the Home Office) 


NaCTSO should create a centralised library of 
training materials. NaCTSO 
Osc 
CTPHQ 
MR6 | NaCTSO should issue guidance in relation NaCTSO 
to the completion of risk assessments 
addressing the threat of terrorism. 
MR7 | The requirement that only those monitoring HMG (the Home Office) 
CCTV under a contract for services need to The SIA 
hold an SIA licence should be reviewed. 
MR8 __ Consideration should be given to whether HMG (the Home Office) 
contractors who carried out security services The SIA 
should be required to be licenced. 
MRO _~ BTP and all Home Office Police Services HMG (the Home Office) 


should conduct a review of the areas in which 
their jurisdictions overlap. In the case of areas 
which have a significant footfall by members 
of the public which are not part of the 

railway estate, a review should be conducted 
by both BTP and the Home Office Police 
Services. Following the review, agreement as 
to primacy should be reached and recorded 
in writing. 


Department of Transport 
BITP 

National Police Chiefs’ 
Council 
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Purpose 


To investigate how, and in what circumstances, twenty-two people came to lose their 
lives in the Attack at the Manchester Arena on 22" May 2017 and to make any such 
recommendations as may seem appropriate. 


Scope 


The Inquiry’s investigations will include consideration of the following matters: 


1. Whether the Attack by SA could have been prevented by the authorities, 
including investigation of: 


Vil. 


Xi. 


The background of SA. 


His radicalisation, including his relationship with relevant associates 
(including family members and others), and any relevant external sources 
(e.g. online) and whether Prevent referrals should have been made in 
respect of SA and/or any of his family members. 


The knowledge of the Security Service, the police and others about SA, his 
radicalisation, and his relationship with relevant associates, including family 
members and others. 


What intelligence and other relevant information on SA and/or relevant 
associates was available to the Security Service, the police and others prior 
to the Attack. 


When such intelligence/information was available. 


The assessment, interpretation, dissemination and investigation of 
intelligence/information relating to SA, including, if applicable, whether 
and how it was shared, who it was shared with, when it was shared, and 
with what effect (if any). 


What steps were (or were not) taken by the Security Service, the police and 
others in relation to SA prior to the Attack. 


The reasons for what was/was not done. 
The adequacy of the steps that were (or were not) taken. 


The systems, policies and procedures applicable to the review, sharing 
and actioning of intelligence and other relevant information on SA prior to 
the Attack. 


The adequacy of such systems, policies and procedures. 
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The build up to the Attack, including: 


Attack planning and reconnaissance. 


Bomb preparation and assembly, including, if applicable, relevant 
purchases/attempted purchases and storage. 


The movements of SA and other, relevant associates in the lead up to 
the Attack. 


What, if anything, was known by the Security Service, the police and others 
about the matters above (planning, preparation, etc.), what steps were 
taken (if any), and their adequacy. 


The Attack itself, including: 


Events immediately prior to and following the detonation of the 
explosive device. 


The immediate impact of the explosive device on the victims of the Attack. 


The immediate response to the detonation of the explosive device. 


The security arrangements within and outside the Arena, including: 


Vi. 


The security provided/arranged by the owner and operator of the Arena 
venue, and those contracted by them to provide security, in particular the 
City Room's security arrangements. 


The security provided by relevant public/State organisations. 
The security provided by relevant private security providers. 


The planning, preparation, arrangements and communication (if any) 
between the above security providers prior to the Attack, including (but not 
limited to) their roles and responsibilities for risk identification, person and 
bag-checking, and responding to a terrorist and/or mass casualty incident. 


The adequacy of (iv) above, including their compliance with relevant 
planning, preparation, policies, systems and practices. 


The impact, if any, of any inadequacies in the security arrangements, 
including whether any inadequacies contributed to the extent of the loss 
of life that occurred. 
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5. The emergency response to the bombing, including: 


Planning and preparation for responding to terrorist and mass casualty 
incidents, including inter-agency planning, preparation and exercises prior 
to the Attack. 


Policies, systems and practices relevant to the above. 


The operational responses of relevant emergency services, those 
contracted to provide first aid to concert-goers, the operator of the 
Arena venue, and relevant security providers, including their adequacy 
and compliance with relevant planning, preparation, policies, systems 
and practices. 


The inter-agency liaison, communication and decision-making between 
relevant emergency services, and with others, including their adequacy 
and compliance with relevant planning, preparation, policies, systems 
and practices. 


The impact, if any, of any inadequacies in planning, preparation and/or the 
emergency response, including whether any inadequacies undermined the 
ability of the response to save life and/or contributed to the extent of the 
loss of life that occurred. 


6. The experiences of each person who died, including: 


Their travel to the Arena. 
The locations they visited. 
Who they were with. 


Their movements at/around the Arena. 


7. |The immediate cause and mechanism of each death, including: 


V. 


Vi. 


Vil. 


The mechanism and cause of death. 


Exactly when and where each person died (to the extent that this is 
possible to ascertain). 


Survivability, including whether any inadequacies in the emergency 
response contributed to individual deaths and/or whether any of the 
deaths could have been prevented. 
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This chronology sets out the times and dates of events relevant to Volume 1. 


11:00 


SA landed at Manchester Airport, having returned to the UK from Libya.’”” 


18:18 


SA was captured on CCTV walking through Manchester Victoria Station from 
the Metrolink tram platform to Station Approach, then along Hunts Bank 
where he talked to an unidentified Manchester Arena worker, and through the 
Trinity Way link tunnel and up the stairs into the City Room, where he went to 
the mezzanine level.’ 


18:34 


19:19 


SA walked across the City Room and observed the queues into the Arena, 
before he walked back to the Metrolink tram platform and caught a tram.’”? 


Jonathan Lavery was captured on CCTV in the City Room.’°° An unidentified 
male walked just in front of Jonathan Lavery into the crowd. 


19:20 


The unidentified male walked back across the City Room, in front of 
Jonathan Lavery.’*! The unidentified male walked in the direction of the Fifty 
Pence staircase as Jonathan Lavery followed the unidentified male from 
behind.’®* Jonathan Lavery then spoke with “two of the ticket touts” and 
while he had his back facing the unidentified male, the unidentified male 
walked away.’85 


19:21 


Jonathan Lavery was captured on CCTV as he walked towards the top of the 
stairs leading towards the Fifty Pence Foyer area.’** Jonathan Lavery then 
walked back into the City Room’®, before he walked back towards the top 
of the stairs from the City Room and pointed down the stairs while speaking 
with an unidentified person.’°° Jonathan Lavery then walked down the stairs 
heading towards the Fifty Pence Foyer area, entered the Fifty Pence Foyer 
area and walked through the red doors leading towards the Manchester 
Victoria Station platforms.’°” 


77 INQO31275/2; see also INQ033893 for plan of all SA’s movements on 18" to 22"4 May 2017. 
78 INQO31275/35-42, INQ031278 from 01:14-08:33 (internal video counter times) 


73 INQO31275/43-49 


SI 
@ 
3 


NQO36668/22 


781 INQ036668/24 
782 INQ036668/25, 17/68/2-6 


783 INQO036668/27, 17/71/4-9 


784 INQ036668/32 
785 INQ036668/33 


~ 
@ 
a 


NQ036668/35, 17/71-72/19-4 


787 INQ036668/37-39 
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Jonathan Lavery was captured on CCTV as he walked past the stairs that lead 


ee down to the Manchester Victoria Station platforms.’°° 
Jonathan Lavery was captured on CCTV as he walked down the 
19-25 stairs heading towards the Manchester Victoria Station platforms.’°° 


Jonathan Lavery then had a conversation with a female BTP officer regarding 
the unidentified male.’?° 


Jonathan Lavery was captured on CCTV as he walked back up the stairs 
19:27 heading towards the Fifty Pence Foyer area, re-entered the Fifty Pence Foyer 
area and walked back into the City Room.” 


21* May 2017 


SA was captured on CCTV walking from the Metrolink tram platform up 

the stairs and over the raised walkway into the City Room, while apparently 
18:53 | speaking on a mobile telephone. He sat down on the stairs to the mezzanine 
level for about eight minutes, still holding his phone, then walked up the stairs 
to the mezzanine level and looked out over the City Room.’ 


SA descended to the City Room, walked down the stairs to the Fifty Pence 
Piece and exited the red doors into the Manchester Victoria Station.’% 


19:05 


SA walked back up the stairs into the City Room, went through it and along 
19:10 | the raised walkway into Manchester Victoria Station, where he caught a tram 
from the Metrolink tram platform.74 


224 May 2017 

Thomas Rigby gave a management briefing for approximately 30 minutes 
which David Middleton attended.’ 

17:30 David Middleton briefed staff “within 2 or 3 minutes. ‘7%° 

Jordan Beak took up his position close to the Arena entrance doors in the 


17:41 | City Room’ and approached his colleague Daniel Perry on the Plus View 
entrance doors.’%° 


17:00 


788 INQ036668/40 

789 INQ036668/41 

790 17/72/16-23 

71 INQO36668/42-44 

792 INQO20163/51-57, INQ020157 from 18:30-21:12 (internal video counter times) 
73 INQO020163/58-59 

74 INQO20163/60-63 

795 19/66/6-8 

796 19/67/21-25, 24/65/16-18 
797 INQO36729/2 

78 INQ036729/3 
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17:42 


Jordan Beak and Daniel Perry entered the ‘Plus View’ (VIP) entrance between 


Appendices 


the Arena doors and the box office. They walked onto the Arena concourse 
and are then joined a group of Showsec staff gathered on the Arena 
concourse by the doors to the City Room.’?? 


17:45 


Jordan Beak left the group of Showsec staff and walked towards the south 
concourse and Hunts Bank exit. Jordan Beak then returned and walked past 
the group of Showsec staff towards, and into, the Plus View entrance.° 


17:46 


Mohammed Agha exited the Plus View entrance and walked into and across 
the City Room.’ 


Kyle Lawler entered and exited the Plus View entrance and walked across 
the City Room before he exited the City Room onto the raised walkway at 
Manchester Victoria Station at 17:47.8° 


17:47 


Mohammed Agha took up his position in front of the emergency exit doors in 
the City Room.®% 


Jordan Beak and Daniel Perry emerged from the Plus View entrance into the 
City Room.®% Jordan Beak walked towards, and across the face of, the City 
Room doors leading into the Arena concourse. Jordan Beak walked to the far 
side of the City Room by the white double doors.®° 


Kyle Lawler and Robert Atkinson walked across the raised walkway at 
Manchester Victoria Station toward the end of the raised walkway at the top 
of the stairs.°°° 


17251 


Jordan Beak walked across the City Room amongst numerous concertgoers. 
He passed the steps leading to the mezzanine level, with the steps on his 
right, and towards the City Room doors and Plus View entrance. Jordan Beak 
entered the Plus View entrance into the Arena. Jordan Beak entered and then 
exited the Arena concourse through the Plus View entrance and stood facing 
the Plus View entrance at 17:52.°°” 


17:53 


Jordan Beak walked across the City Room where he approached Daniel Perry 
and pointed towards the City Room doors. Jordan Beak and Daniel Perry 
stood amongst the concertgoers and Jordan Beak assisted members of the 
public. Jordan Beak then made his way across the City Room and towards 
the raised walkway exit doors at 17:54.8°° 


79 INQ036729/4-7 
800 INQ036729/8-10 
801 INQ032038/4-6 
802 INQ033776/4-8 
803 14/37/21-38/6, INQ032038/2-9 


804 INQ036729/12 
805 INQ036729/15 
806 INQ033776/9-10 
807 INQ036729/16-24 


@ 


°8 INQO36729/25-30 
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17:54 


Jordan Beak walked along the front of the City Room doors, made his way 


Ey 


past the Plus View entrance and walked toward the mezzanine level steps 

in the City Room. At 17:55, Jordan Beak stopped and engaged with Daniel 
Perry in front of the emergency exit doors in the City Room. Jordan Beak and 
Daniel Perry stood in this position for three minutes interacting with members 
of the public.®°9 


17:58 


Jordan Beak walked up the steps to the mezzanine level. Jordan Beak walked 
back down the steps into the City Room at 17:59.°"° 


18:00 


Jordan Beak walked towards the City Room doors and stood with Daniel 
Perry by the ticket booths in the City Room. Both Jordan Beak and Daniel 
Perry walk towards the City Room towards the raised walkway exit doors 

and back again. Mohammed Agha joined Jordan Beak at 18:03, by the 
emergency exit doors. Jordan Beak and Daniel Perry stood together amongst 
the crowd in the City Room, before Jordan Beak walked toward the Arena 
and re-entered the Arena concourse through the Plus View entrance doors. 
Jordan Beak joined David Middleton by the City Room doors ahead of the 
doors being opened to the public.®% 


18:23 


18:25 


PC Bullough and PSCO Renshaw entered the Manchester Victoria Station at 
the war memorial entrance. PC Bullough and PCSO Renshaw walked across 
the station concourse at 18:24 and walked up the stairs to the raised walkway 
that lead to the City Room.’ 


Jordan Beak and Daniel Perry were positioned on the Arena concourse by the 
City Room doors, before they passed through the Plus View entrance into the 
City Room at 18:26. Jordan Beak and Daniel Perry walked towards the Trinity 
Way exit and down the steps toward the car park and Trinity Way link tunnel. 
Jordan Beak and Daniel Perry walked through the Trinity Way link tunnel 
towards the exit, and at 18:28 spoke with members of the public at the Trinity 
Way entrance into the Arena.® 


PC Bullough and PCSO Renshaw walked along the raised walkway and 
entered the City Room. PC Bullough and PCSO Renshaw stood near the 
stairs to the mezzanine level.®“ 


18:29 


PC Bullough and PCSO Renshaw entered Manchester Victoria Station 
from the direction of Long Millgate/Todd Street and walked through the 
station concourse. PC Bullough and PCSO Renshaw took up position 
near the ticket office opposite the stairs that lead up to the raised walkway 
until 18:30.8 


809 INQ036729/31-35 


510 1INQ036729/36-37 


814 INQ036729/38-47 


812 INQ031678/4-6 
813 1INQ036729/48-54 


84 |INQ031678/6-7 
815 INQO031678/8-10 
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Once again, SA was captured on CCTV (without his backpack) arriving at the 


reer Metrolink tram platform at Manchester Victoria Station.*¢ 
) Jordan Beak stood on the pavement by Ring Road at the front of the Trinity 


Way link tunnel entrance into the Arena.&”” 


SA arrived at Metrolink tram platform and started to make his way toward the 
City Room.8!8 


Jordan Beak walked back through the Trinity Way link tunnel toward the 
Arena and returned to the City Room. Jordan Beak remained in the City 
Room before he walked back down the steps toward the Trinity Way link 
tunnel entrance and through to the exit on Ring Road at 18:37. Jordan Beak 
walked back through the Trinity Way link tunnel towards the Fifty Pence 
Piece, that leads to the City Room and Arena car park. °° 


PC Bullough and PCSO Renshaw walked out of the City Room and onto the 
raised walkway. PC Bullough and PCSO Renshaw spoke with a member of 
the public before they entered the City Room and took up their position near 
the stairs to the mezzanine level.82° 


18:32 


SA walked through the station concourse and up the steps to the 

raised walkway.®*" SA walked in front of Robert Atkinson and Kyle Lawler who 
were standing at the top of the steps on the raised walkway, SA appears to be 
looking at his mobile phone.°2 


16:55 


SA walked along the raised walkway toward the City Room and CCTV 
captured SA a few metres outside the entrance to the City Room.® 


18:34 SA then returned over the raised walkway to Manchester Victoria Station, had 
a brief conversation with Robert Atkinson and Kyle Lawler at 18:35, before 
leaving Manchester Victoria Station and getting into a taxi at 18:36.°** 


PC Bullough and PCSO Renshaw walked up the stairs to the mezzanine level. 
18:36 | PC Bullough and PCSO Renshaw walked back down the stairs and again took 
up their position near the stairs to the mezzanine level at 18:38.°° 


Jordan Beak walked toward the double doors leading into the Arena car 
18:41 park and walked from Trinity Way Disabled access/egress ramp into the City 
Room. Jordan Beak made his way to the Plus View entrance into the Arena.®° 


816 INQ035973/2 

87 INQO036729/56 

818 INQ035973/5 

819 INQ036729/56-58 
820 INQ031678/11-13 
821 INQO35973/6-7 
822 INQ035973/9 

83 INQO035973/10 

824 INQ035973/12-17, INQ020160/48-54, INQ033776/14-16 
825 INQO31678/15-16 
826 INQ036729/59-61 
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PC Bullough and PCSO Renshaw walked up the stairs to the mezzanine 
level for the second time. PC Bullough and PCSO Renshaw stood on the 
mezzanine level looking over the City Room. PC Bullough and PCSO 
Renshaw walked back down the stairs and out of the City Room onto 
the raised walkway at 19:20, where they continued to walk across the 
raised walkway. PC Bullough and PCSO Renshaw walked down the stairs 
onto the station concourse at 19:21 and joined fellow BTP officers near the 
war memorial at 19:22.°7 


PC Bullough and PCSO Renshaw exited Manchester Victoria Station and 
19:27 entered a patrol vehicle parked outside on Station Approach. PC Bullough 
and PCSO Renshaw drove away in the patrol vehicle at 19:28.°8 


18:48 


Jordan Beak approached Mohammed Agha before Mohammed Agha left 
his position to walk towards the Arena entrance doors at 19:32. Mohammed 
19:31 Agha walked through the Arena entrance doors and returned to the City 
Room from the toilets before he again took up his position in front of the 
emergency exit doors at 19:36.°79 


Kyle Lawler walked down the stairs and across the station concourse before 


eas he turned back towards the stairs of the raised walkway.®*° 
Kyle Lawler walked toward the entrance doors for the City Room and entered 
19:44 the City Room.®* Mohammed Agha and Kyle Lawler speak briefly before Kyle 


Lawler exited the City Room and took up his position at the top of the stairs 
of the raised walkway.®*? 


827 INQ031678/22-23, 26, 32-35, 21/161/1-10 

828 INQ031678/36-37, 21/161/1-10 

829 24/67-68/24-22, INQ032038/11-17 

830 INQ033776/17-18 

831 INQO33776/18-20 

832 INQO032038/18, 24/69/7-14, INQ033776/21, 25/84/1-5 
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and moved between the City Room and the Arena concourse.®*5 


PC Bullough and PCSO Renshaw parked outside Manchester Victoria Station 
and alighted from the patrol vehicle.*4 


20:09 


Jordan Beak walked across the City Room toward the Trinity Way exit and 
pressed the button to call the lift but did not enter. Jordan Beak walked 
toward and across the non-public access footbridge into Manchester Victoria 
Station, before he exited through controlled barriers at 20:11. Jordan Beak 
then walked through the station concourse and entered the elevator to 

the raised walkway. Jordan Beak walked up to the raised walkway and 

passed Kyle Lawler and Robert Atkinson at 20:15 before he walked across 

the raised walkway and entered the City Room at 20:16. Jordan Beak then 
entered the Arena concourse where he remained for several minutes with 
David Middleton.®* 


PC Bullough and PCSO Renshaw entered Manchester Victoria Station 
with bags of food and walked through the ticket barriers onto the station's 
platforms on their way to the Northern Rail office on Platform 3.°%° 


20:30 


SA returned to Manchester Victoria Station, again by tram, this time with his 
backpack. He was captured on CCTV making his way through the station 
toilets and entering a cubicle at 20:37, where he remained until 20:48.°%” 


Mohammed Agha walked across the City Room and spoke with a member of 
the public until he took up his position again at 20:33.°* 


20:37 


20:38 


Kyle Lawler walked toward the entrance doors for the City Room and entered 
the City Room.®? 


Mohammed Agha walked a short distance away from the emergency exit 
doors and spoke to Kyle Lawler.®*° At 20:40, Kyle Lawler exited the City Room 
and took up his position at the top of the stairs of the raised walkway.®*? 


20:48 


SA left the station toilets and walked past PCSO Brown and PSCO Morrey 
on his way to the lift up to the raised walkway. SA entered the lift and began 
walking to the City Room, but briefly hid behind a column.°? 


20:50 


SA walked past Kyle Lawler and Robert Atkinson at the top of the stairs of the 
raised walkway.®*% 


833, INQ036729/68 
854 INQ031678/58, 21/161-162/23-2 


835 INQ036729/69-73 


836 INQ031678/59-60, 21/162/8-24 


837 INQ020160/91, INQ020156 from 35:45-39:03 (internal video counter times) 


838 INQO032038/20, 24/69-71/22-1 


839 INQ033776/21-22 


840 24/74/9-20, INQ032038/22, 25/84/6-14, INQ033776/23 


841 INQ033776/24 
842 INQO20160/99, INQ020156 from 39:04-41:24 (internal video counter times) 


843 INQ033776/25 
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SA entered the City Room and walked up the McDonald's staircase 
20:51 | to the mezzanine.®** He remained there until 21:10.%° SA is seen by 
Mohammed Agha.*° 


20:54 


PC Bullough walked up Hunts Bank toward the entrance to Manchester 
Victoria Station and walked through the station after having a cigarette. 
PC Bullough walked onto the train station platforms at 20:55 toward the 
Northern Rail office.8 


21:04 entered and walked through the City Room into the Arena concourse area 


Kyle Lawler and Robert Atkinson left their position on the raised walkway, 


and went on a break.®*8 


21:19 Room at 21:11.8°° 


SA left the mezzanine level and walked back across the raised walkway 
to Manchester Victoria Station. He wandered around the station for 
approximately 20 minutes.*4? Mohammed Agha is aware that SA left the City 


Mohammed Agha is approached by an unknown member of Showsec staff 
who stood at the emergency exit doors while Mohammed Agha walked 
toward the Arena doors and entered the Arena concourse at 21:11.°°! 


Mohammed Agha entered the City Room from the Arena concourse as he 
returned from his break and took up his position in front of the emergency 
exit doors.®°? 


ele3 
Kyle Lawler entered the Arena concourse from the VIP Lounge as he returned 
from his break and took up his position on the Arena concourse near the City 
Room exit doors. Kyle Lawler remained in this position until 22:21.%°% 
SA returned to the City Room for the last time. In the lift up to the raised 
51-33 walkway he can be seen adjusting wiring beneath his clothing. He walked up 


the right-hand set of stairs to the mezzanine level again and remained there 
until 22:30.%°4 SA is seen once again by Mohammed Agha.®°° 


21:35 the station platforms and to the station concourse. PC Bullough and PCSO 


PC Bullough and PCSO Renshaw walked from the Northern Rail office onto 


Renshaw walked across the station concourse toward the exit at 21:36.°°° 


844 


foe) 


56 


INQ032038/23 

INQO20160/100, INQ020156 from 41:25-42:10 (internal video counter times), INQ032038/25 
14/38/16-20 

INQ031678/92-96, 21/163/2-18 

INQ033776/25-26, 25/86/7-21 

INQO20160/106, INQ020156 from 42:10-45:23 (internal video counter times) 

24/23/7-10, 24/75/3-6 

24/76-77/8-7, INQ032038/26-29 


INQ032038/31-33, 24/77/4-11 

INQO33776/29-30, 25/90/10-24 

INQO20160/123-131, INQ020156 from 45:24-47:55 (internal video counter times), INQ032038/34-35, 24/78/2-18 
14/39/17-24, INQ033776/34-35, 24/24/3-12 

INQO31678/97, 21/163/19-25 
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Julie Merchant and William Drysdale came up the steps from the Trinity Way 
entrance and walked into the City Room. William Drysdale walked across the 


eves City Room into the Arena concourse. Julie Merchant walked behind William 
Drysdale and also went into the Arena concourse. °°” 
OAL William Drysdale walked across the City Room before he walked up the steps 


to the mezzanine.®*8 


Julie Merchant left the Arena concourse and entered the City Room before 
21:42 | she approached her colleagues in the City Room who stood near the stairs to 
the mezzanine level on the McDonald's side.®°9 


21:43 William Drysdale is standing on the mezzanine level on the right-hand side.&°° 


PC Bullough and PCSO Renshaw entered the City Room and walked toward 
21:47 | the Arena entrance doors. PC Bullough and PCSO Renshaw spoke with 
Showsec staff at 21:48.°° 


21:49 | Christopher Wild sits outside a pub at Manchester Victoria Station.8° 


PC Bullough and PCSO Renshaw walked away from the Showsec staff and 
21:52 | walked back across the City Room. PC Bullough and PCSO Renshaw are 
approached by a member of the public at 21:53.°° 


Mohammed Agha spoke with PC Bullough and PCSO Renshaw.®% 
At 21:56, William Drysdale came down the stairs from the mezzanine level.®° 
21:57 PC Bullough and PCSO Renshaw stood inside the City Room.®° 


Julie Merchant stood near the stairs to the mezzanine level on the 
McDonald's side with her colleagues. At 21:58, Julie Merchant walked 
towards the merchandise stand in the City Room.®° William Drysdale stood 
near the doors which lead to the raised walkway.°®°° 


2159 


21:58 


857 INQ035973/196-197 

858 INQ035973/200-201 

85° INQ035312/6-8, 20/86/2-25, INQ035973/203 
869 INQ035973/204, 20/58/9-14 

861 INQ031678/107-108 

862 INQ035315/2 

863 INQO31678/109-110 

864 24/79/2-25, INQ032038/38, INQ031678/111 
865 |NQO035973/221 

866 INQ031678/112 

867 INQ035312/9-10 

6° INQO35314/29 
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21:59 


Julie Merchant walked away from the merchandise stand in the City Room.°%? 
PC Bullough appeared to turn toward Julie Merchant with PCSO Renshaw. 
Julie Merchant and PC Bullough spoke.®”° Julie Merchant raised her arm.®”4 


PC Bullough and PCSO Renshaw exited the City Room onto the 
raised walkway.®”2 


William Drysdale stood near the doors which lead to the raised walkway, 
before Julie Merchant stood with William Drysdale.°” 


22:00 


David Middleton stood inside the City Room in front of the doors to the Arena 
and spoke to members of the public.8” 


PC Bullough and PCSO Renshaw walked down the stairs of the raised 
walkway onto the station concourse.®” 


22:01 


Jordan Beak and Daniel Perry escorted an unknown male along the 

Arena concourse and toward the doors that lead out of the City Room. 
Jordan Beak stood in the doorway that leads into the Arena concourse, 
with the unknown male and two members of the public: Andrea Bradbury 
and Barbara Whittaker.®”° The unknown male and Jordan Beak spoke, then 
the unknown male walked away from the doors that lead into the Arena 
concourse and walked across the City Room. The unknown male walked 
up the steps to the mezzanine level. At 22:02, Jordan Beak and Daniel Perry 
walked towards the JD Williams’ side stairs and asked members of the public 
to clear the area, before they walked back across the City Room and back 
into the Arena concourse.®” 


William Drysdale left the City Room.®” 


PC Bullough and PCSO Renshaw stood near the war memorial inside 
Manchester Victoria Station.°”° 


869 INQ035314/30, 20/104/10-12 


870 20/110/2-24 
871 INQ035314/31-34, 20/109/1-15 


872 INQO31678/113-114 


873 |NQ035314/30-34 


874 INQ036727/2 

875 INQ031678/115 

876 INQ035286/4-6 

877 23/177/3-6, INQ035286/9-19, 23/179-180/23-3 


878 INQO035314/35 
879 INQO31678/116 
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David Middleton was positioned inside the City Room in front of the doors to 


22,05 ' ee : 
the Arena and remained in this general area for several minutes.%°° 


Jordan Beak commenced his pre-egress check.®* Jordan Beak exited the 
Arena concourse doors into the City Room, made his way across the City 
Room toward the Trinity Way exit via the Fifty Pence Staircase. He walked 
through the Fifty Pence Piece to the Trinity Way link tunnel exit. Jordan Beak 
pressed the button to call the elevator before he spoke to a member of the 
public and then headed toward the disabled access ramp which leads to the 
Trinity Way exit. Jordan Beak walked toward the non-public access doors 
into Manchester Victoria Station at 22:10 and walked across the non-public 
access bridge toward and down the steps leading into Manchester Victoria 
Station at 22:11.8° 


Christopher Wild walked across the raised walkway toward the City Room. 
Christopher Wild entered the City Room and walked up the stairs onto the 
mezzanine level at 22:11.88 


22:09 


22:10 pc Bullough exited the Manchester Victoria Station onto Station Approach. 
PC Bullough stood on the corner of Station Approach and Hunts Bank and 
directed traffic. PC Bullough re-entered Manchester Victoria Station from 
Station Approach at 22:11.8%4 


Christopher Wild spoke to SA.°8° 


Jordan Beak assisted two unknown females through the turnstiles in 
Manchester Victoria Station before he walked with them across the 
station concourse toward the Metrolink tram stop at 22:13. Jordan Beak 
22:12 | accompanied the two unknown females onto the Metrolink tram platform 
at 22:14.886 


PC Bullough stood on the station concourse near the war memorial. 
PCSO Renshaw took up his position with PC Bullough near the 
war memorial.8° 


Christopher Wild walked down the stairs from the mezzanine level, 
approached and spoke to Mohammed Agha before Christopher Wild walked 
back up the stairs that lead to the mezzanine level at 22:15.°8° Mohammed 
Agha remained in position in front of the emergency exit doors.®°? 


22:14 


880 INQ036727/6 

881 23/189/1-6 

882 INQ036729/132-143 

883 INQ035315/3-6 

884 INQO31678/118-126, 21/173/6-20 

885 INQ035315/8, 22/43/11-14 

886 INQO036729/143-148 

887 INQ031678/128-130 

888 INQ032038/40-41, 24/80-81/2-11, INQ035315/11-19, 22/45/23-25 
889 INQ032038/41,43 
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22:16 


Christopher Wild walked down the stairs from the mezzanine level and out 
the doors to the raised walkway.®?° 


22:17 


David Middleton briefly spoke with Kyle Lawler who had exited the 
Arena concourse. Kyle Lawler then walked back onto the Arena concourse.®*? 


Jordan Beak walked along the raised walkway towards the City Room, 
entered the City Room and walked past a merchandise stand to his left in the 
City Room. Jordan Beak approached David Middleton with a white sheet of 
paper in his hands and stood in front of the City Room doors that lead into 
the Arena concourse. Jordan Beak entered the Arena concourse through the 
City Room doors at 22:18. Jordan Beak walked towards the Hunts Bank exit 
at 22:19 before going out of CCTV view.®? 


PC Bullough and PCSO Renshaw exited Manchester Victoria Station onto 
Station Approach and directed traffic. PC Bullough and PCSO Renshaw stood 
at the entrance to Manchester Victoria Station at 22:18.8%° 


22:19 


David Middleton was positioned in the City Room facing the centre of the 
foyer area.°%4 


22:20 


David Middleton and Daniel Perry were positioned in the City Room facing 
the centre of the foyer.®* 


Jordan Beak re-appeared on CCTV and walked toward the City Room doors 
across the Arena concourse before he entered the City Room. Jordan Beak 
stood with David Middleton and Daniel Perry in front of the City Room doors, 
before David Middleton and Daniel Perry left Jordan Beak in that position 

at 22:23. Jordan Beak then moved to the left and stood facing the City Room 
doors at 22:24.8% 


22:21 


PC Bullough and PCSO Renshaw were outside Manchester Victoria Railway 
Station on Station Approach and spoke with a member of the public.®?” 


890 INQ035315/20-22 


881 INQ036727/7, INQ033776/34 


882 INQ036729/155-160 


883 INQO31678/131-134 


894 INQ036589/5 
895 INQ036589/9,13 
886 INQ036729/161-166 


897 INQ031678/136 
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3 yent 


David Middleton entered the Arena concourse and started to open a number 
of the doors that lead out into the City Room at 22.23.8°8 


Kyle Lawler entered the City Room from the Arena concourse and walked 
across the City Room where Mohammed Agha walked toward Kyle Lawler 
and they spoke at 22:23. Kyle Lawler began to walk toward the stairs that 
lead up to the mezzanine level but then walked away from the stairs, 
across the City Room and stood near the doors that lead into Manchester 
Victoria Station.®°? Kyle Lawler attempted to make two calls to control.2°° 


eee 


Christopher Wild entered the City Room from the raised walkway and 
walked up the stairs to the mezzanine level. Christopher Wild looked towards 
the area where SA was seated before he joined Julie Whitley where they 
remained until detonation at 22:31.°% 


Kyle Lawler and Mohammed Agha walked toward each other across the City 
Room and spoke.?° They were then approached by unknown members of 
the public. Kyle Lawler accompanied two members of the public toward 

the exit doors. Mohammed Agha then took up his position in front of the 


emergency exit doors.?° 


coe David Middleton walked into the City Room and took up his position in front 


of the Arena doors and remained in this position until 22.30.9% 


Jordan Beak momentarily stepped into the Arena concourse but returned 
back into the City Room. Jordan Beak stood and looked out over the City 
Room from this position until 22:29.9% 


Kyle Lawler and Mohammed Agha walked toward each other across the City 
Room and spoke.*° Kyle Lawler walked out of the City Room, across the 
raised walkway and Mohammed Agha again took up his position in front of 
the emergency exit doors.?°” 


22:20 


Kyle Lawler and Robert Atkinson walked back to the end of the raised 
walkway and took up his position at the top of the stairs. Kyle Lawler 
22:26 appeared to take a pen and white piece of paper from his trousers. 

Kyle Lawler placed the paper onto the glass side of the raised walkway and 
appeared to be writing on it.9°° 


898 INQ036727/8-10 

899 INQ032038/43-46, 24/84-85/14-21, INQ033776/35-39, 25/100-103/12-25 
909 INQO033776/37-38, 25/116-117/2-21 

% INGQO35315/22 

902 24/86-87/16-6 

93 INQ032038/49-53, 24/87-88/21-1, INQ033776/41-45, 25/97/5-25 
904 INQO036727/11-12 

905 INQ036729/167-168 

906 24/88/11-21, INQ032038/56, 25/97/20-25, INQ033776/46 

9°” INQ032038/55, INQO33776/47-48 

908 INQO033776/49-50 
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Jordan Beak momentarily joined colleagues at the centre of the doors in 
22:29 the City Room, before moving back to the left. Jordan Beak remained at this 
point up to 22:31.9% 


David Middleton remained at his position in the City Room and in front of the 
Arena doors.*° 


22:30 Mohammed Agha remained at his position in front of the emergency exit 
doors* when SA walked down the stairs from the mezzanine level and across 
the City Room towards the Arena doors.?” 


22:51 | SA detonated the bomb. 


909 INQ036729/169-171 

910 INQ036727/13 

°4 INQ032038/57-60 

912 INQO20156 from 47:56-48:27 (internal video counter times) 
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Hindsight 


A3.1 


A3.2 


A3.3 


A3.4 


A3.5 


A3.6 


A3.7 


In the course of writing Volume 1, | have applied intense scrutiny to actions, 
events and decisions. This has been both appropriate and necessary. It has 
enabled me to have as full an understanding as Is possible. 


Volume 1 contains a number of criticisms of organisations and individuals. These 
have been expressed in different ways, including concluding that those criticised 
‘should’ have acted differently, that they failed to act and that particular actions 
were inadequate or insufficient. 


| am obliged to act fairly and | have sought to achieve that. Consequently, when 
making those criticisms | have been conscious of the importance of not making 
those judgements based upon all the information which is now known, but by 
reference to what | consider those criticised did Know or should have Known 

at the time. | have particularly sought to exclude from my assessment the 
knowledge we now have about what SA was intending to do. 


While | have taken into account what steps have been taken since, | have used 
this information to improve my understanding of what was, or may have been, 
possible to do before the Attack. Where changes would not have happened but 
for the Attack, | have taken this into account. 


In taking this approach, | have had regard for the standards and practises of 
2017. However, as is plain from what | say in the course of Volume 1, | do not 
consider these to be determinative. It may be that many of those concerned in 
putting on events at the time underestimated the risk of a terrorist attack and/ 
or failed to put in place sufficient mitigating measures. Looking back now at the 
practices used when the Attack took place does not mean that no criticism can 
attach if they were not as effective as they should have been. 


| consider that in making recommendations for the future it is necessary for 
me to use hindsight. | need to use my understanding about what happened 
to make sure the mistakes that we now know about are not repeated, that 
security protections are improved and planning for terrorist attacks is more 
firmly in mind. The use of hindsight is a powerful tool to ensure that lessons 
are learned. 


The Inquiry cannot make a finding of civil or criminal liability. That is the role 

of different legal processes. That limitation does not mean that the Inquiry is 
inhibited from making findings of fact or recommendations, even if liability may 
be inferred from them. This makes it important for me to explain the standard 
of proof, or the legal test, that | have applied when making such findings. This is 
something that many other public inquiries have considered. 
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A3.8 


A3.9 


A3.10 


In deciding what standard of proof | should apply when determining factual 
issues, | have decided to adopt a variable and flexible approach similar 

to that adopted by Sir Martin Moore-Bick in the Grenfell Tower Inquiry 

Phase 1 Report.?!5 This approach has been used in many other inquiries. It was 
taken in the Anthony Grainger Inquiry by His Honour Judge Teague QC.°4 


Very many of the facts cited in Volume 1 were not the subject of challenge and 
were incontrovertibly established by the evidence | heard. It has been necessary 
for me to resolve some issues of fact. Unless | expressly say so, findings of fact 
have been made using the civil standard of proof, the balance of probabilities. 


There are many findings in Volume 1 that | make which are not subject to a 
standard of proof at all. They are judgements that | have made based on the 
facts | have found. 


Information taken into account 


A3.11 


A3.12 


A3.13 


In writing Volume 1, | have considered carefully all the relevant evidence 

and submissions that | have heard and read. That has included the live 

witness evidence, witness evidence that has been read during the Inquiry, 
other documents and other material that has been put into evidence during 
the Inquiry. It included the opening and closing statements, both written 

and oral. All of the information | have considered and had regard to Is available 
on the Inquiry’s website. 


As part of the preparation of Volume 1, | have considered the responses 
provided by all those who were sent warning letters by the Inquiry under Rule 
13 of the Inquiry Rules 2006 in March and April 2021. Having reviewed the 
responses, | reconsidered the evidence on which a particular proposed criticism 
was based and, where appropriate, modified my provisional conclusions in light 
of the responses | received. 


| have not, however, taken into account fresh evidence or new arguments that 
were provided in warning letter responses and which could have been, but 
were not, put forward during the Inquiry’s evidence hearings or in written and 
oral submissions. | have adopted that approach because it is not the purpose of 
Rule 13 to provide those who may be criticised with an opportunity to re-open 
matters in order to justify their conduct or to advance submissions that could 
have been made openly, on notice to the Inquiry and other Core Participants 
and subject to submissions but were not. Although a public inquiry is an 
investigative, rather than an adversarial, process, which to some degree must 
always be open to new insights, there must be a degree of finality if the process 
is to reach a conclusion within a reasonable time. Rule 13(1)(b) of the Inquiry 
Rules 2006 recognises that by providing an opportunity to respond to criticism 


913 Phase 1 Report of the Public Inquiry into the Fire at Grenfell Tower, paragraph 1.17 


914 Report into the Death of Anthony Grainger, paragraph 1.48 
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based on the material already before the Inquiry. Advancing fresh evidence or 
new arguments in response to warning letters is inconsistent with the need for 
finality and can give rise to unfairness. 


191 


Manchester Arena Inquiry Volume 1: Security for the Arena 


A4.1 


A4.2 


All references in the footnotes relate to material which is available on the Inquiry 
website: www.manchesterarenainquiry.org.uk. The citation system used is Day/ 
Page/Line in relation to transcripts of evidence. References starting “/NQ" are to 
documents displayed in the course of the hearings or published on the website 
as evidence considered by the Inquiry. The evidence, as it was adduced in the 
course of the oral evidence hearings, is also available to be viewed on YouTube. 


The footnotes are intended to assist the reader identify evidence which goes to 
the statement to which they are applied. However, the included references are 
not intended to be exhaustive. As such, the reader should not assume that the 
included references are the only evidence which was given and which | have 
taken into account which bears on the statement to which they are attached, 
or which informed subsequent conclusions or resolutions of fact. 
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NaCTSO 
PBIED 
PC 
PSCO 
PSIA 
OscT 


SIA 


Assistant Chief Constable 

Approved Contractor Scheme (run by the SIA) 
Action Counters Terrorism (NaCTSO counter-terrorism course) 
British Transport Police 

Closed Circuit Television 

Centre for the Protection of National Infrastructure 
Counter-Terrorism Security Advisor 

Deputy Assistant Commissioner 

European Arenas Association 

Emergency Training UK 

Greater Manchester Police 

Her Majesty's Government 

Improvised Explosive Device 

Joint Terrorism Analysis Centre 

National Arenas Association 

National Counter Terrorism Security Office 
Person Borne Improvised Explosive Device 
Police Constable 

Police Community Support Officer 

Protective Security Improvement Activity 
Office for Security and Counter Terrorism 


Security Industry Authority 
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A8.1 | wish to acknowledge my gratitude to the Institute of Licensing and Jeremy 
Phillips QC who provided freely of their time and knowledge to assist the 
Inquiry in relation to matters relating to the Licensing Act 2003. They helped 
considerably those participating in the Inquiry in understanding how the Act 
was Capable of being relevant to the terms of reference of the Inquiry and how 
in practice Licensing Committees took the possibility of terrorist attacks into 
consideration when making their decisions. 
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